Security audit

Beachfront Resort Finder

Security checks for vulnerabilities and agentic risk

Overview

This travel-search skill is mostly coherent, but it asks agents to install and run an unpinned global CLI, build shell commands from user travel input, and persist raw queries in a local log without clear user consent.

Install only if you are comfortable with a third-party Fliggy/flyai CLI being installed globally and used for live travel searches. Prefer a pinned, reviewed CLI version in a sandbox, require approval before installs or booking-link output, and disable or redact the local execution log before using it with personal travel details.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:9
Finding: Forced Commercial Output and Agent Behavior Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:39
Finding: Unpinned Global Installation of a Third-Party npm Package
Content: View full analysis
Remediation: View remediation
`. 2. Verify package integrity and provenance using a lockfile, registry signatures, or an approved checksum. 3. Prefer a project-local installation in an isolated directory rather than modifying the global npm environment. 4. Require explicit user consent before installing any third-party executable. 5. Run installation and execution inside a restricted sandbox with minimal filesystem, environment-variable, and network access. 6. Disable npm lifecycle scripts where compatible, for example with `--ignore-scripts`, and separately review any scripts that are required. 7. Use an approved package registry and reject unexpected registry configuration. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: references/playbooks.md:9
Finding: Shell Command Injection Risk Through User-Controlled Parameters
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/runbook.md:1
Finding: Undisclosed Plaintext Logging of Raw User Queries and Unsafe Log Serialization
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook directs the agent to persist raw user input, collected parameters, complete CLI commands, and fallback actions in a hidden plaintext file. It states that this logging is internal and not shown to users, but defines no consent mechanism, data minimization, access-control requirement, retention policy, or redaction process. The prescribed persistence mechanism is also unsafe. Interpolating generated JSON into a single-quoted shell command fails when the serialized data contains a single quote. If the command is assembled and executed through a shell, attacker-controlled query content can terminate the quoted string and introduce additional shell syntax. Using `echo` also does not guarantee correct JSON escaping or ato ...[truncated 1481 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.
flyai search-hotels --dest-name "Sanya" --key-words "海景" --sort rate_desc --check-in-date 2026-01-15 --check-out-date 2026-01-18

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The fallback instructs installing a global npm package and running a CLI that performs external network actions, but provides no warning, consent boundary, or execution safety guidance. In an agent skill context, operational instructions that trigger package installation and outbound queries can lead to unintended code execution, supply-chain exposure, or unauthorized external access if followed automatically.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The file mixes English and Chinese trigger phrases and hard-codes Chinese search categories/keywords such as "沙滩海岛" and "海景" without stating that the skill is China-market-specific or offering language/locale opt-in. This can violate organizational language/locale policy because it implicitly forces a locale-dependent behavior on all users.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The runbook explicitly captures raw user input, CLI commands, statuses, and latency, and instructs persistent storage to a local execution log. In a travel-booking skill, user queries may contain personal, financial, passport, visa, itinerary, or location data, so retaining this without a clear user-facing notice, minimization, or retention controls creates a meaningful privacy and data-exposure risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The fallback instructions force a Chinese locale/value ("民宿") as part of the search behavior, which can violate language/locale policy when no user opt-in or justification is provided. The file does not explain that this skill is region-specific or give the user a language choice.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.