flightroutes24 ai

• Outcome: Review
• Latest audit: May 30, 2026 · 8:13 AM UTC
• Version: 1.0.3

Overview

This flight-booking skill fits its stated purpose, but it needs review because it can create real orders, stores sensitive passenger and credential data locally, and includes unrelated Git publishing permissions plus test auth-bypass switches.

Install only after reviewing the high-impact parts: remove the packaged Git remote/push permission file if not required, do not use the skip-auth or skip-IP-whitelist flags outside isolated testing, prefer environment or a secure secret store over .cache/keys.json, clear .cache after bookings, and confirm all passenger, price, refund, and order details before allowing the final order command.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (19)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares no required permissions, yet its documented behavior clearly includes network access, shell command execution, environment-variable secret handling, and reading/writing local files such as .cache. This permission mismatch is dangerous because it obscures the skill's real capabilities from the host/user, reducing informed consent and weakening policy enforcement around secrets, filesystem access, and external API calls.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: This skill grants the agent permission to add Git remotes and push to them, capabilities that are unrelated to searching flights or booking tickets. If the skill or any prompt influencing the agent is abused, these permissions enable exfiltration of repository contents or unauthorized code/configuration changes to external destinations, which materially increases the blast radius.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger list includes the very broad everyday term “飞”, which can match many unrelated user messages and cause the travel-booking skill to activate unexpectedly. In this skill's context, accidental activation is more dangerous than usual because the skill can perform searches, handle passenger data, access configured secrets indirectly, and potentially place real orders after conversational flow progresses.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document instructs the agent to collect, parse, display, and locally cache highly sensitive passenger and contact data, including passport numbers, birth dates, phone numbers, and email addresses, but does not warn about privacy, retention, masking, or safe handling. In a booking skill, this creates a real risk of unnecessary exposure of personal data to logs, downloads, screenshots, or local cache leakage.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The flow includes a final order-creation step after a simple confirmation prompt, but does not explicitly warn that booking/order submission may be financially binding, irreversible, or time-sensitive. In a travel-booking context, insufficient warning can lead to accidental purchases, disputes, or unauthorized transactions if the agent proceeds on ambiguous consent.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The skill hard-codes Chinese-language prompts and examples for supplying sensitive booking data, with no language negotiation or alternative path. In a flight-booking workflow, forcing a specific language can cause users to misunderstand required fields or confirmation steps, leading to incorrect passenger data, failed bookings, or unintended transactions.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The workflow requires exact Chinese confirmation phrases to proceed with verification and order creation. In a transactional context, exact-language gating is risky because users may not understand the phrase requirement, or may accidentally trigger or fail to trigger high-impact actions due to translation or comprehension issues.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The CLI persists sensitive booking credentials to .cache/keys.json on disk without any visible warning, permission hardening, or encryption. On multi-user systems, shared environments, backups, or accidentally committed cache directories, these secrets could be exposed and then used to query or place bookings against the flight procurement API.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The search request payload is persisted to a local file before the search runs, with no evidence in this file of user notice, minimization, retention controls, or protection of potentially sensitive travel data. In a flight-booking skill, payloads can include passenger details, itinerary preferences, contact information, or other personal/travel metadata, so silent local storage increases privacy and data exposure risk on shared or compromised systems.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code stores a booking context file containing the original search payload, selected offer, trace identifiers, and fare options without any visible consent or disclosure mechanism in this file. For a travel-booking skill, that context can reveal sensitive itinerary and transaction-related information, creating a meaningful privacy and local data leakage risk if another user, process, or attacker can access the cache directory.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pycryptodome>=3.20.0
pypinyin>=0.51.0

• Confidence: 91% confidence
• Finding: The dependency is specified with a lower bound only, which allows future versions to be installed without review and makes builds non-reproducible. This increases supply-chain risk because a breaking or vulnerable release could be pulled in unexpectedly during installation.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pycryptodome>=3.20.0
pypinyin>=0.51.0

• Confidence: 90% confidence
• Finding: This package is also unpinned, so installs are not deterministic and may resolve to different versions over time. That creates a supply-chain weakness by allowing unintended package changes, including the possibility of introducing vulnerable or malicious upstream releases.

Known Vulnerable Dependency: pycryptodome — 3 advisory(ies): CVE-2018-15560 (PyCryptodome integer overflow vulnerability); CVE-2023-52323 (PyCryptodome and pycryptodomex side-channel leakage for OAEP decryption); CVE-2018-15560 (PyCryptodome before 3.6.6 has an integer overflow in the data_len variable in AE)

High

• Category: Supply Chain
• Confidence: 96% confidence
• Finding: The requirement allows installation of pycryptodome versions that may include known vulnerable releases, and the advisory set includes serious cryptographic issues such as side-channel leakage and older memory/integer handling flaws. In a flight-booking skill that may process secrets, tokens, or encrypted business data, a weak crypto library materially increases confidentiality and integrity risk.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

"FR_NEWAPI_APPKEY": "appkey",
    "FR_NEWAPI_SIGN_SECRET": "signSecret",
    "FR_NEWAPI_AES_SECRET": "aesSecret",
    "FR_NEWAPI_SKIP_AUTH": "skipAuth",
    "FR_NEWAPI_SKIP_IP_WHITELIST": "skipIpWhitelist",
}

• Confidence: 88% confidence
• Finding: The skipAuth mapping is part of the accepted external configuration surface, meaning a plaintext file or environment variable can toggle off normal authentication behavior. That expands the risk of misconfiguration and makes unauthorized use more likely in real deployments, especially for a travel-booking skill handling purchasing flows.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

"FR_NEWAPI_APPKEY": "appkey",
    "FR_NEWAPI_SIGN_SECRET": "signSecret",
    "FR_NEWAPI_AES_SECRET": "aesSecret",
    "FR_NEWAPI_SKIP_AUTH": "skipAuth",
    "FR_NEWAPI_SKIP_IP_WHITELIST": "skipIpWhitelist",
}

• Confidence: 88% confidence
• Finding: The skipAuth mapping is part of the accepted external configuration surface, meaning a plaintext file or environment variable can toggle off normal authentication behavior. That expands the risk of misconfiguration and makes unauthorized use more likely in real deployments, especially for a travel-booking skill handling purchasing flows.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

NEWAPI_APP_KEY = _read_config("FR_NEWAPI_APPKEY")
NEWAPI_SIGN_SECRET = _read_config("FR_NEWAPI_SIGN_SECRET")
NEWAPI_AES_SECRET = _read_config("FR_NEWAPI_AES_SECRET")
NEWAPI_SKIP_AUTH = _read_config_bool("FR_NEWAPI_SKIP_AUTH")
NEWAPI_SKIP_IP_WHITELIST = _read_config_bool("FR_NEWAPI_SKIP_IP_WHITELIST")
FR24_API_HEADER = "fr24-api"

• Confidence: 84% confidence
• Finding: FR_NEWAPI_SKIP_IP_WHITELIST is also accepted from config, indicating the skill can disable an additional network-based control. While IP allowlisting alone is not sufficient security, making its bypass configurable increases exposure and compounds the risk if other controls are weakened.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

NEWAPI_APP_KEY = _read_config("FR_NEWAPI_APPKEY")
NEWAPI_SIGN_SECRET = _read_config("FR_NEWAPI_SIGN_SECRET")
NEWAPI_AES_SECRET = _read_config("FR_NEWAPI_AES_SECRET")
NEWAPI_SKIP_AUTH = _read_config_bool("FR_NEWAPI_SKIP_AUTH")
NEWAPI_SKIP_IP_WHITELIST = _read_config_bool("FR_NEWAPI_SKIP_IP_WHITELIST")
FR24_API_HEADER = "fr24-api"

• Confidence: 84% confidence
• Finding: FR_NEWAPI_SKIP_IP_WHITELIST is also accepted from config, indicating the skill can disable an additional network-based control. While IP allowlisting alone is not sufficient security, making its bypass configurable increases exposure and compounds the risk if other controls are weakened.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

def is_newapi_configured() -> bool:
    if not NEWAPI_APP_KEY:
        return False
    if NEWAPI_SKIP_AUTH:
        return True
    return bool(NEWAPI_SIGN_SECRET)

• Confidence: 96% confidence
• Finding: The is_newapi_configured() function explicitly returns true when NEWAPI_SKIP_AUTH is set, even if no signing secret exists. That is a concrete insecure default/logic flaw: the skill will consider itself properly configured for API use without normal authentication material, enabling unauthorized or weakly authenticated operations if downstream code trusts this check.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

```powershell
$env:FR_NEWAPI_SKIP_IP_WHITELIST='1'
$env:FR_NEWAPI_SKIP_AUTH='1'
```

## 全流程自动化测试

• Confidence: 98% confidence
• Finding: The documentation explicitly instructs maintainers to set FR_NEWAPI_SKIP_IP_WHITELIST=1 and FR_NEWAPI_SKIP_AUTH=1 in a test environment, which disables key access-control protections. Even though marked as 'test only', documenting bypass flags in maintainer setup increases the chance they are enabled in the wrong environment or copied into production-like deployments, allowing unauthorized access to booking or shopping APIs.

Static analysis

No suspicious patterns detected.