Security audit

Ancient Inn

Security checks for vulnerabilities and agentic risk

Overview

The skill’s travel-planning purpose is coherent, but it tells agents to install a global third-party CLI automatically and may persist travel queries in local logs.

Review before installing. This skill is not clearly malicious, but it may change your system by globally installing a third-party npm CLI and may keep local logs of travel queries if the referenced runbook is included. Install only if you trust the flyai CLI source, are comfortable with live travel lookups and booking links, and can control or disable any local logging.

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly instructs the agent to run a global npm installation (`npm i -g @fly-ai/flyai-cli`) as part of normal execution, without any user consent, warning, or sandbox requirement. This modifies the host environment and expands the attack surface by introducing third-party code execution during routine query handling.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The fallback instructs installing a global CLI (`npm i -g @fly-ai/flyai-cli`) directly from the skill content, without disclosure, trust boundaries, version pinning, or safer alternatives. In an agent setting, this can lead to unreviewed code execution or environment modification on the host system, which is especially risky because fallback logic may be triggered automatically under failure conditions.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The runbook explicitly records the raw user query in an internal execution log, which can capture personal data, travel details, account references, or other sensitive inputs. Because the schema also implies retention and later rendering of risk-related notes, this creates a privacy and data-minimization issue if logs are stored or accessed without clear notice, consent, redaction, and retention controls.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The runbook instructs appending execution logs to a local file, which can persist user activity and command history on disk without warning or safeguards. In a travel-booking context, these logs may include sensitive itinerary, identity, or booking-related details, increasing exposure if the host is shared, compromised, backed up, or improperly permissioned.

Static analysis

No suspicious patterns detected.