Security audit

Beachfront Resort Finder

Security checks for vulnerabilities and agentic risk

Overview

This travel-search skill is coherent, but it needs review because it can install an unpinned global CLI and store raw travel queries locally without clear consent.

Install only if you trust the flyai CLI and are comfortable sending travel search details to that provider. Require approval before any `npm i -g` command, prefer a pinned local or sandboxed install, and disable or delete `.flyai-execution-log.json` if you do not want travel queries stored locally.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill explicitly frames the agent as a CLI executor and directs it to install and run a global npm package without any user confirmation or warning about modifying the host environment. This is dangerous because it can cause unauthorized system changes, execute untrusted third-party code during installation, and expand the attack surface on the machine running the agent.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The prerequisites section includes a global installation command as a normal setup step, but does not disclose that this will alter the user's system or require elevated trust in a third-party package. In an agent context, such instructions can lead to silent environment modification and arbitrary code execution through the package install lifecycle.

Missing User Warnings

High

Confidence: 99% confidence
Finding: This workflow mandates automatic installation of the CLI whenever the command is missing, and explicitly forbids safer fallback behavior. That makes the skill more dangerous because it converts a normal missing dependency condition into an unconditional instruction to fetch and execute external code, potentially without user awareness or consent.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The fallback instructs installation of a global npm package (`npm i -g @fly-ai/flyai-cli`) directly on the user's system without disclosure, consent, or safer alternatives. In an agent skill context, this can cause persistent environment changes, introduce supply-chain risk from package installation, and violate least-privilege expectations for a read/query workflow.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The runbook explicitly records `user_query` as raw input and instructs the agent to append the generated log JSON to a local file if filesystem writes are available. Because this skill handles travel workflows that can include highly sensitive personal and trip-planning data, persisting raw queries without clear minimization, consent, retention limits, or sanitization creates a real privacy and data-exposure risk.

Static analysis

No suspicious patterns detected.