Security audit

last-minute

Security checks for vulnerabilities and agentic risk

Overview

This flight-search skill is coherent, but it asks agents to install a global CLI and keep local logs of raw travel requests without clear consent controls.

Review before installing. Only allow the flyai CLI installation if you trust that package and explicitly approve global or sudo-level changes. Avoid entering passport numbers, emergency details, or other sensitive personal information unless you are comfortable with those details being sent to the provider and potentially retained in a local log.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill instructs the agent to install a CLI automatically if it is missing, which modifies the host environment without explicit user consent or a safety warning. In an agent setting, automatic package installation can introduce supply-chain risk and unauthorized system changes, especially if executed on developer workstations or CI runners.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The fallback path explicitly runs `npm i -g @fly-ai/flyai-cli`, a global install that changes the system state and trusts a remote package without any warning, pinning, or verification. If an agent executes this automatically, it can expose the host to malicious or compromised packages and violate least-privilege expectations.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs users to run a global npm install and then escalate to `sudo npm i -g`, which can execute package install scripts with root privileges and modify the host system. In a skill context, this is dangerous because it normalizes privileged installation of an external package without warning, verification guidance, or safer alternatives, increasing the risk of system compromise if the package or dependency chain is malicious or tampered with.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The runbook explicitly logs `user_query` as `{raw input}` in an internal execution log, while also stating the log is not shown to users. In a travel-booking skill, raw input can contain sensitive personal and travel data such as names, locations, dates, passport/visa details, emergency travel context, or other confidential information, creating an unnecessary privacy and data-retention risk without disclosure or minimization.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The runbook instructs persistent filesystem logging by appending the generated execution log to `.flyai-execution-log.json`, which can silently retain user data and operational metadata on disk. In this skill's context, persisted logs may capture sensitive travel-related requests and command history, increasing exposure through local compromise, misconfigured permissions, backups, or unintended reuse beyond the original request.

Static analysis

No suspicious patterns detected.