airport-pickup-service

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:48 AM UTC
• Version: 1.0.0

Overview

This travel-booking skill is not clearly malicious, but it requires broad unpinned CLI execution, provider-only booking output, and raw local logging that users should review before installing.

Install only if you are comfortable with a third-party travel CLI receiving your travel queries and with the agent installing global npm tooling. Prefer a pinned, reviewed CLI version, disable or delete .flyai-execution-log.json logging, and avoid entering sensitive itinerary, identity, payment, or account details until privacy and retention behavior is clarified.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:10

Finding

Provider-Controlled Instruction and Output Hijacking

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:67

Finding

Shell Command Injection Through User-Derived Query Interpolation

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/runbook.md:7

Finding

Raw User Data Persistence and Shell Injection in Execution Logging

Content

View full analysis

> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook directs the Agent to retain the complete raw user query, generated commands, fallback commands, and execution metadata. Airport-transfer requests can contain itinerary details and other personal information, but the design provides no consent mechanism, redaction, retention policy, access control, encryption, or secure deletion procedure. The persistence command introduces a separate command-injection flaw. Generated JSON is placed inside a single-quoted shell argument. If any attacker-controlled field contains a single quote, it c ...[truncated 1427 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: SKILL.md:41

Finding

Unpinned Global Installation and Execution of Third-Party Dependencies

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

flyai keyword-search --query "机场接送 上海"

text

## Output Rules

1. **Conclusion first** — lead with the key finding
2. **Comparison table** with ≥ 3 results when available

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest frames this as an airport transfer booking skill, but the README says it wraps flyai-cli to provide 'real-time travel data with booking links,' which is a broader travel capability. This materially exceeds the narrow airport-pickup purpose described elsewhere and suggests behavior beyond just transfer booking.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The README promotes booking services and generating booking links via external travel tooling without warning that user itinerary details, locations, and possibly personal travel metadata may be transmitted to third-party services. In a travel-booking context, that omission matters because users may disclose sensitive trip information without informed consent or understanding of where their data goes.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The README instructs users to execute npx skills ... without pinning a specific package version, which can cause retrieval and execution of whatever version is current at install time. That creates a supply-chain risk because a compromised or unexpected upstream release could be pulled and run by users or agents without review.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill asserts that all user-facing data must come from CLI output, yet later embeds standalone travel advice and price ranges for 'output enrichment.' That contradiction weakens provenance guarantees and can cause the agent to mix unverified prompt content with tool-derived results, creating a prompt-level data integrity issue and making policy bypass or hallucinated advice more likely.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The activation conditions include generic phrases like "pickup" and "drop off," which are common in everyday speech and not specific to airport-transfer bookings. This can cause unintended skill activation for unrelated requests such as picking up items or dropping someone off outside an airport context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The runbook explicitly logs user_query as raw input and records full CLI command history, then states the log may be appended to a local file. This creates a real privacy and retention risk because travel-related requests can contain personal, financial, or itinerary data that may be stored without minimization, consent, redaction, or access controls.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The schema combines natural-language user_query, step-by-step operational metadata, and optional filesystem persistence via echo ... >> .flyai-execution-log.json. In a travel-booking context, this is especially sensitive because user queries may include names, flight details, hotels, visa info, and other personal trip data, increasing the chance of local data leakage, over-retention, or secondary exposure.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The manifest frames this as an airport-pickup booking skill, while the 'Domain Knowledge' section includes advice about taxis, ride-hailing, airport buses, and metro/train options, including pricing heuristics, that are not tied to the documented CLI booking workflow. This broadens the skill from booking transfer services into general travel advice, which is not clearly reflected in the primary description.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.