Security audit

ancient-town-explorer

Security checks for vulnerabilities and agentic risk

Overview

This travel skill is purpose-aligned overall, but it requires unpinned global CLI installation, writes hidden raw-query logs, and uses shell-style command templates with user input.

Install only if you are comfortable with a third-party FlyAI CLI being installed and used for travel searches. Require explicit approval before any npm or npx command, prefer a pinned or isolated CLI install, avoid entering sensitive personal or booking details, and disable or delete the hidden .flyai-execution-log.json logging behavior unless you intentionally want local query logs.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:9
Finding: Mandatory Vendor Workflow Hijacks Agent Behavior and Output
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:58
Finding: Unpinned Global Installation and Execution of Third-Party npm Package
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:79
Finding: User-Controlled City Values Are Interpolated into Shell Command Templates
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/runbook.md:7
Finding: Raw User Queries Are Persisted Through an Injection-Prone Shell Logging Command
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook directs the agent to record the complete raw user query in a hidden local file. Travel queries can contain names, dates, destinations, contact information, accessibility needs, financial constraints, or other personal details. The project provides no consent mechanism, minimization policy, redaction, retention period, file-permission requirement, or deletion procedure. The persistence mechanism also embeds generated JSON inside a single-quoted shell string. If raw input contains a single quote and the JSON is substituted textually, that quote can terminate the shell string. Additional shell syntax can then be interpreted as a command. JSON escaping does not provide shell escaping because JSON and shell quoting are different syntactic contexts. The log is described as internal and “not shown to users,” which further r ...[truncated 1380 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (15)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.
flyai search-poi --city-name "Jiaxing" --category "古镇古村"

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The README instructs users to run npx skills add ... without pinning a specific package or version, which can cause retrieval and execution of whatever package/version is current at install time. This creates a supply-chain risk: a compromised or typosquatted package, or a later malicious update, could be executed in the user's environment during installation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly instructs the agent to install a global npm package automatically if the CLI is missing, which modifies the host environment without prior user consent or a safety warning. In an agent setting, this can lead to unreviewed code being fetched and executed from the package registry, increasing supply-chain and system-integrity risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The Prerequisites section recommends npm i -g @fly-ai/flyai-cli as a default setup step without warning that it performs a global install and changes the system environment. Users or agents may execute it reflexively, exposing the machine to package-install side effects and potential registry compromise.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The workflow mandates automatic installation after a failed environment check, effectively instructing the agent to alter the system before responding. This is dangerous because it couples ordinary query handling to package installation, enabling unintended execution of external code and violating least-privilege expectations for a travel-information skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instruction "Try Chinese/English variants" imposes specific language handling as the prescribed fallback behavior. This is a natural-language locale policy concern because the file does not indicate user choice, opt-in, or a documented region-specific reason for restricting or prioritizing these languages.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The command hard-codes the category value in Chinese ("古镇古村"), which imposes a specific language/locale behavior without any user opt-in or documented justification. This can conflict with language-choice policy when users have not requested Chinese-language operation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The command includes the hard-coded Chinese keyword "水乡" and the file does not indicate that users can select another language or that the skill is region-specific. That creates a natural-language policy concern by forcing a locale-specific term implicitly.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The command hard-codes the keyword "古村" in Chinese, but the document does not offer language choice or explain that the playbook is intentionally limited to a Chinese-language context. This may violate language/locale policy by imposing a specific locale implicitly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The runbook explicitly stores the raw user query in an internal execution log, which can capture sensitive travel data such as names, destinations, booking details, passport or visa-related information, and other personal context. Because the document provides no notice, minimization, redaction, or retention controls, this creates a real privacy and data-handling risk if logs are accessed, retained too long, or reused outside the original request flow.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The runbook instructs the agent to append execution logs to a local file, which can persist user-derived data to disk beyond the active session. In a travel-booking skill context, persisted logs may include sensitive itinerary, booking, or identity-related information, increasing exposure through unauthorized file access, backup leakage, multi-tenant environments, or accidental retention.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The README states that the skill wraps a CLI to provide real-time travel data and booking links, which implies network access and external data transmission, but it does not warn users about that behavior. In a skill ecosystem where users may expect local-only assistance, lack of disclosure can undermine informed consent and lead to unintended sharing of queries, itinerary details, or other travel-related data with third-party services.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The activation phrase is a short, generic natural-language term that could plausibly appear in ordinary user requests, but the file does not define boundaries, exclusions, or a narrower invocation context. This creates ambiguity about when the playbook should activate versus when the phrase is merely descriptive.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The trigger is a common descriptive phrase with no surrounding activation constraints, exact-match requirement, or exclusion examples. Without clearer scope, the skill may activate unintentionally on ordinary discussion of travel or geography.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This trigger is expressed as a broad natural-language phrase and the document does not specify context, exclusions, or precise matching behavior. That leaves uncertainty about whether mentioning the phrase in general conversation should invoke the playbook.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.