Security audit

airport-transit-hotel

Security checks for vulnerabilities and agentic risk

Overview

This travel skill is mostly coherent, but it asks agents to install and run an unpinned global CLI and to persist raw travel queries locally without clear user control.

Review before installing. This skill may download and globally install a third-party npm CLI, send travel searches to the flyai/Fliggy service, show booking links, and write raw queries plus command logs to a local file. Install only if you are comfortable with that provider dependency and disable or constrain logging where possible.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:10
Finding: Forced Commercial Output and Service-Channel Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:65
Finding: Automatic Execution of Unpinned Third-Party Packages
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/runbook.md:5
Finding: Unredacted Persistent Logging of Raw User Queries and Commands
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook directs the agent to record the complete raw user query, collected parameters, every CLI command, and fallback commands. It then appends the generated record to a plaintext project-local file. The instructions provide no consent mechanism, data minimization, redaction, retention limit, access-control requirements, or deletion procedure. Travel queries may contain sensitive details such as dates, locations, accommodation plans, names, or other personal information. Commands can also inadvertently contain secrets if future ...[truncated 2219 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.
flyai search-hotel --dest-name "Shanghai" --key-words "浦东机场" --sort distance_asc --check-in-date 2026-05-01 --check-out-date 2026-05-02

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The description says the skill also supports flight booking, hotel reservation, train tickets, attraction tickets, itinerary planning, visa info, travel insurance, car rental, and more, which is far broader than the airport-transit-hotel scope. In a manifest/markdown context, this can create ambiguous trigger scope and unintended invocation because it does not clearly constrain which travel intents belong to this skill versus other skills.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The file defines activation triggers in both English and Chinese, including Chinese-only phrases like "机场酒店" and "中转休息", but provides no user opt-in or explanation that the skill is intended for Chinese-language usage. This can violate language/locale policy because it hard-codes locale-specific activation behavior without documenting user choice or justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The runbook explicitly records raw user input in user_query and states that the execution log is maintained internally, creating a privacy risk if users include personal, financial, or travel-sensitive data. Because this is a travel/booking-related skill, queries may contain names, dates, airports, itineraries, booking details, or other sensitive information, and the document provides no minimization, consent, retention, or redaction guidance.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The schema combines raw user_query capture with persistent local append logging, which creates a straightforward data retention and exposure issue rather than a purely theoretical concern. In this skill context, users may submit itinerary details, visa questions, insurance needs, or booking-related identifiers, so retaining verbatim requests can expose sensitive personal travel information if logs are accessed or mishandled.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The runbook instructs appending execution logs to a local file without any safeguards around file permissions, retention, encryption, or operator awareness. Persisting logs to disk increases the chance that sensitive travel queries and operational metadata remain accessible to other processes, users, backups, or later compromise.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README states that the skill provides real-time travel data and booking links, which implies user queries or itinerary details may be sent to external services, but it gives no warning about third-party data sharing or booking-site interactions. In a travel-booking context, users may disclose sensitive itinerary or personal travel information without understanding that external processing or redirection is involved.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The Parameters table states --sort is always distance_asc, which implies the skill should never use other sort values. However, Playbook B later instructs use of --sort price_asc, directly contradicting the earlier documentation rather than merely adding detail.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest says the skill is powered by Fliggy (Alibaba Group), but the user-facing templates say 'Powered by flyai' and instruct users to use a 'flyai' CLI for real-time data. This is a semantic mismatch between the claimed service/provider in the manifest and what the documentation suggests the skill actually relies on.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.