travel-emergency-assistant

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:43 AM UTC
• Version: 1.0.1

Overview

The skill is a travel-emergency helper, but it asks agents/users to install and possibly run a global CLI with root privileges, which is too much host access for the task.

Review before installing. Use this skill only if FlyAI CLI is already provisioned by a trusted administrator or installed in a contained, non-root environment. Avoid `sudo npm install -g` and avoid changing global npm registry settings for this skill. Treat prices, availability, and booking links as live external data that should be verified on the booking page.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:315

Finding

Unpinned Global Dependency Installation with Optional Root Privileges

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 315 and 328-329
Vulnerability Type: Unpinned third-party package installation and unsafe privilege guidance
Risk Level: High

Vulnerable code snippets:

bash

npm install -g @fly-ai/flyai-cli

markdown

| **Insufficient permissions** | Suggest using `sudo npm install -g @fly-ai/flyai-cli` or managing Node with nvm |
| **Network issue** | Suggest checking the network or using the mirror `npm config set registry https://registry.npmmirror.com` |

Technical Analysis

The Skill instructs users to install @fly-ai/flyai-cli globally without pinning an exact version or verifying an integrity hash. Consequently, the effective code installed and executed may change after the Skill itself has been reviewed.

npm packages can execute lifecycle scripts during installation. A compromised package release, dependency, maintainer account, or registry response could therefore execute arbitrary code on the host. Global installation also modifies the user's shared Node.js environment rather than containing the dependency within this project.

The recommended sudo fallback increases the severity: package lifecycle scripts and installation operations may execute with root privileges. The repository provides no lockfile, vendored implementation, checksum, or dependency declaration that would permit reproducible verification of the installed payload.

The mirror guidance additionally changes the user's global npm registry configuration. That persistent configuration affects unrelated future npm operations and expands the trust boundary beyond this Skill.

Attack Path

1. The Skill checks whether flyai is available by running which flyai.
2. If it is absent, the user is directed to install the latest available @fly-ai/flyai-cli release globally.
3. An attacker compromises the package, one of its transitive dependencies, its publisher account, ...[truncated 1252 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin @fly-ai/flyai-cli to an exact, reviewed version rather than resolving the latest release.
2. Record the complete dependency graph in a lockfile and enforce integrity verification during installation.
3. Declare the CLI as a project-local dependency and invoke it through a local package runner or explicit local path.
4. Do not recommend sudo npm install; preserve least privilege and fail safely when permissions are insufficient.
5. Avoid changing the user's global npm registry. If a mirror is necessary, scope it to an isolated command or project configuration and document the associated trust assumptions.
6. Audit package lifecycle scripts, transitive dependencies, network endpoints, and data-handling behavior before permitting installation.
7. Run the CLI in a sandbox or restricted execution environment with minimal filesystem, network, and environment-variable access.
8. Verify package provenance using signed releases, trusted publisher controls, and approved integrity hashes.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest display name and description are entirely in Chinese, and the embedded agent prompt instructs the assistant in Chinese throughout. There is no indication that users may choose another language or that the locale restriction is intentionally limited to a region-specific deployment, which creates a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The core operating instructions, output schema, and behavioral requirements are all specified in Chinese, implying a Chinese-language-only interaction model. Because the file does not state that this is a region-specific tool or provide a user-selectable language option, it may violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

L251 的兜底策略写明“API 超时”时可“降级为模拟数据演示”，但 L089-L090 与 L294-L295 明确要求必须使用真实数据，CLI 失败时应明确告知并且“不使用演示数据降级”。这是文档内部对技能行为预期的直接矛盾，属于意图与说明不一致。

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs the agent to check for and install a system-level CLI (which flyai, npm install -g ..., flyai --help) before performing its task. In an agent context, this expands scope from travel assistance into host modification and package installation, which can alter the runtime environment, pull untrusted code from registries, and violate least-privilege boundaries.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The skill explicitly recommends sudo npm install -g @fly-ai/flyai-cli, which normalizes privileged package installation during agent operation. In security-sensitive environments, encouraging root-level npm execution is dangerous because it can grant full system compromise if the package, dependency chain, or install scripts are malicious or tampered with.

Content

Scanner excerpt · SKILL.md (reported line 328)May include surrounding context.

md

| 情况 | 处理方式 |
|------|---------|
| **npm 未安装** | 提示用户先安装 Node.js (https://nodejs.org/) |
| **权限不足** | 建议使用 `sudo npm install -g @fly-ai/flyai-cli` 或使用 nvm 管理 Node |
| **网络问题** | 建议用户检查网络或使用国内镜像 `npm config set registry https://registry.npmmirror.com` |

**注意**：此步骤只在首次使用时执行，后续调用会直接跳过已安装的情况。

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The package description is written as a Chinese-only user-facing skill description and does not indicate that users can choose another language or locale. This can violate language/locale policy when the skill appears to mandate a specific language experience without explicit opt-in or justification.

Content

No source excerpt is available for this finding.