Travel Swarm

• Outcome: Review
• Latest audit: May 28, 2026 · 3:56 AM UTC
• Version: 1.0.0

Overview

This travel planner is broadly purpose-aligned, but it contains unsafe local command execution, embedded/exposed API keys, and optional watchdog/deployment steps that can affect the host machine.

Install only in an isolated environment and review the code first. Do not expose it publicly or provide real API keys until shell=True command paths are removed, embedded keys are rotated/removed, status/debug endpoints are cleaned up, and watchdog/deployment scripts are either deleted or gated behind explicit operator control.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (58)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cmd = f'{self.cli_path} search-flight --origin "{origin}" --destination "{destination}" --dep-date "{date}"'
        
        try:
            result = subprocess.run(
                cmd, 
                shell=True, 
                capture_output=True,

• Confidence: 99% confidence
• Finding: The code builds a shell command by interpolating untrusted parameters (`origin`, `destination`, `date`) into a string and executes it with `subprocess.run(..., shell=True)`. This enables command injection because shell metacharacters inside user-controlled values can break out of the quoted arguments and execute arbitrary commands on the host.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cmd = f'{self.cli_path} search-train --origin "{origin}" --destination "{destination}" --dep-date "{date}"'
        
        try:
            result = subprocess.run(
                cmd,
                shell=True,
                capture_output=True,

• Confidence: 99% confidence
• Finding: This train-search path has the same unsafe pattern: a command string is assembled from attacker-controlled inputs and passed to a shell. An attacker can inject shell syntax via any parameter to run arbitrary OS commands, leading to code execution in the application's context.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cmd = f"npx @fly-ai/flyai-cli search-hotel --city '{city}' --checkin '{checkin_date}' --checkout '{checkout_date}'"
        
        try:
            result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=30)
            
            if result.returncode == 0:
                data = json.loads(result.stdout)

• Confidence: 99% confidence
• Finding: The command string is built with untrusted inputs (`city`, `checkin_date`, `checkout_date`) and executed with `shell=True`, which creates a direct command injection path. An attacker can break out of the quoted arguments and execute arbitrary shell commands on the host running this skill.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

import subprocess
        
        cmd = f"npx @fly-ai/flyai-cli search-flight --origin '{origin}' --destination '{destination}' --dep-date '{date}'"
        result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=30)
        
        if result.returncode == 0:
            data = json.loads(result.stdout)

• Confidence: 99% confidence
• Finding: The code builds a shell command with f-string interpolation of user-controlled parameters (`origin`, `destination`, `date`) and executes it with `subprocess.run(..., shell=True)`. This is a classic command injection sink: an attacker can break out of the quoted arguments and execute arbitrary OS commands in the host environment.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 尝试FlyAI酒店CLI
        try:
            cmd = f"npx @fly-ai/flyai-cli search-hotel --city '{city}' --checkin '{checkin_date}' --checkout '{checkout_date}'"
            result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=30)
            
            if result.returncode == 0:
                data = json.loads(result.stdout)

• Confidence: 99% confidence
• Finding: The hotel search path also constructs a shell command from user-influenced values (`city`, `checkin_date`, `checkout_date`) and executes it with `shell=True`. This allows command injection and arbitrary local command execution, made worse by the generic `except: pass` that can hide failures and reduce visibility into exploitation attempts.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cmd = f'{self.CLI_PATH} search-flight --origin "{origin}" --destination "{dest}" --dep-date "{date}"'
        
        try:
            result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=30)
            if result.returncode == 0:
                # 解析FlyAI返回的JSON
                data = json.loads(result.stdout)

• Confidence: 99% confidence
• Finding: The code builds a shell command string using user-controlled values (`origin`, `dest`, `date`) and executes it with `subprocess.run(..., shell=True)`. Quoting with double quotes is not sufficient to prevent shell metacharacter expansion or command injection, so an attacker could execute arbitrary OS commands in the process context.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cmd = f'{self.CLI_PATH} {city} "{query}"'
        
        try:
            result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=30)
            if result.returncode == 0:
                # 解析美团返回的链接
                # 提取dpurl.cn链接

• Confidence: 99% confidence
• Finding: The code builds a shell command with untrusted inputs (`city` and `query`) and executes it with `shell=True`. This enables command injection, allowing an attacker to append shell metacharacters and execute arbitrary OS commands under the application's privileges.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cmd = f'{self.CLI_PATH} {city} "{query}"'
        
        try:
            result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=30)
            if result.returncode == 0:
                # 提取dpurl.cn链接
                links = re.findall(r'http://dpurl\.cn/[a-zA-Z0-9]+', result.stdout)

• Confidence: 99% confidence
• Finding: This is the same unsafe pattern in the hotel search path: user-controlled values are inserted into a shell command string and executed via `shell=True`. An attacker can exploit crafted input to run arbitrary commands or alter the invoked program's behavior.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

fliggy_links = []
        try:
            cmd = f'{FLIGGY_CLI} search-flight --origin "{origin}" --destination "{dest}" --dep-date "{date}"'
            result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=30)
            if result.returncode == 0:
                # 解析飞猪链接（示例）
                fliggy_links = [

• Confidence: 99% confidence
• Finding: This builds a shell command from user-controlled form fields (`origin`, `dest`, `date`) and executes it with `shell=True`. An attacker can inject shell metacharacters to run arbitrary OS commands on the server, making this a classic command injection issue rather than a harmless subprocess call.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

meituan_links = []
        try:
            cmd = f'{MEITUAN_CLI} {origin} "{origin}{dest}机票"'
            result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=30)
            if result.returncode == 0:
                meituan_links = [
                    {"flight": "CA1285", "time": "11:40→15:10", "price": "￥2100", "link": "http://dpurl.cn/7BElJMsz"}

• Confidence: 99% confidence
• Finding: This command concatenates user-controlled travel fields into a shell string and runs it via `subprocess.run(..., shell=True)`. Because `origin` and `dest` come from HTTP POST parameters, an attacker can inject additional shell syntax and achieve arbitrary command execution.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The class documentation explicitly states that execution should be blocked until convergence reaches 0.8, but can_execute() permits execution once convergence is only 0.5. This policy/implementation mismatch can cause downstream components to act on incomplete or incorrectly inferred user requirements, undermining the safety gate the engine is supposed to enforce.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The module advertises real flight lookup via Ali MCP and Ctrip, but it never performs any network query and instead returns fabricated mock flight data and generic booking links. In an agent skill, this is dangerous because downstream logic or users may rely on false availability, pricing, or booking information, enabling deception, bad decisions, or unsafe automation based on nonexistent results.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The POI cross-provider verification is implemented incorrectly: Tencent search results are returned under the 'pois' key by tencent_search_poi(), but verify_poi() reads 'data' instead. This causes Tencent counts to appear as zero, making the verification decision and provider recommendation unreliable; in a navigation/recommendation skill, that can mislead downstream logic and users into trusting an invalid 'verified' result.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: This file presents itself as an API client but introduces unnecessary local shell execution capability via `npx`, expanding the attack surface beyond normal network calls. In skill/agent contexts, hidden command-execution pathways are especially dangerous because they let remote input influence local process execution.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The hotel search method similarly adds unjustified shell-execution capability through `npx`, which is inconsistent with an API-client role and broadens what attacker-controlled input can reach. In this context, that hidden capability materially increases risk because user travel inputs become operands to local command execution.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The example backend code builds a shell command by interpolating untrusted parameters (`origin`, `destination`, `date`) and executes it with `shell=True`. If any of those values are user-controlled, an attacker can inject shell metacharacters and execute arbitrary commands on the host, which is far more dangerous than a normal API call.

Intent-Code Divergence

Medium

• Confidence: 99% confidence
• Finding: The /api/status endpoint returns the value of AMAP_API_KEY directly to any caller, which discloses a live secret without authentication or operational need. Exposed API keys can be abused for unauthorized API usage, quota exhaustion, billing impact, and may aid further compromise if the key is trusted by downstream services.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The `/api/travel` endpoint presents itself as a user-driven travel planning API but ignores the supplied `message` and always generates a fixed Hong Kong itinerary. This is a semantic integrity flaw: downstream users or agents may trust the response as personalized, causing incorrect bookings, privacy/compliance issues, or unsafe automation decisions based on false assumptions.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The `/api/select_plan` endpoint accepts a `plan` parameter but ignores it, regenerating a fixed itinerary instead of selecting the user's chosen option. This can mislead users and connected systems into believing a confirmed selection was honored, which undermines workflow integrity and could produce unauthorized or incorrect travel artifacts.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The script loads a secret from the environment and uses it to make outbound requests to a third-party LLM service, which is a sensitive capability. In this file the prompt content is hardcoded and there is no obvious exfiltration of local data, so the issue is more about unnecessary external network/credential use without clear justification than direct malicious behavior.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The code makes an additional outbound call to a second provider, expanding the external attack and data-sharing surface beyond the primary service. Using the same authorization header for a fallback/test path increases the risk of accidental credential disclosure to the wrong vendor or unintended third-party transmission.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This section instructs use of `kill -9` against whatever process is bound to port 7860 without any confirmation, process identity verification, or warning about service disruption. In an agent skill context, blunt process-termination guidance is dangerous because it can disrupt unrelated workloads or critical services if the port mapping is unexpected or manipulated.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The deployment prompt chains unsafe operational actions: force-killing the process on port 7860, recursively deleting cache paths, and launching long-running background services. In an autonomous or semi-autonomous agent setting, these instructions could be executed without adequate review, causing denial of service, loss of forensic state, or accidental interference with another application using the same port.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The auto-recovery test intentionally kills the live service to simulate failure, but omits any warning that this is a disruptive test and should only be run in a safe environment. In production-like deployments, that can trigger avoidable downtime and recovery churn, especially if performed by an agent following instructions literally.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The troubleshooting advice recommends `kill -9` and recursive cache deletion as routine remediation without warning about impact or validation of the target. That creates a hazardous operational pattern where an agent or novice user may terminate the wrong process or remove files in the wrong directory.

Static analysis

No suspicious patterns detected.