trade-fair

• Analyzed: Apr 24, 2026, 7:41 AM
• Findings: 1
• Version: 3.2.0
• Hash: 1c774d181f20d3a7996ef0d6452af66b5377f41ca748f9b3f49c1b39b0bb820c
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill instructs the agent to perform a global installation of an external NPM package (`npm i -g @fly-ai/flyai-cli`) if the CLI tool is missing (SKILL.md, references/fallbacks.md). While this behavior is aligned with the stated purpose of providing flight search capabilities, the automated global installation of third-party software is a high-risk operation that could facilitate remote code execution or supply chain attacks.