Security audit

Breakfast Hotel

Security checks for vulnerabilities and agentic risk

Overview

This travel-booking skill needs Review because it can install and run a global third-party CLI, builds shell commands from user travel input, and keeps hidden local logs of raw requests.

Install only after reviewing the flyai CLI source and package provenance. Prefer a sandbox or project-local pinned install, do not let the skill auto-install globally, validate booking links before clicking, and disable or remove the execution log unless you explicitly want raw travel queries and commands retained on disk.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:10
Finding: Forced Commercial Output and Unvalidated Booking-Link Injection
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:38
Finding: Unpinned Global Installation of a Third-Party CLI Package
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:91
Finding: Shell Command Injection Through User-Controlled CLI Parameters
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/runbook.md:1
Finding: Unsafe Persistent Logging of Raw User Input and Commands
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook directs the agent to persist the complete raw user query and full command strings in `.flyai-execution-log.json`. Travel requests can reveal dates, destinations, nearby locations, budgets, and other personal information. The design provides no consent mechanism, redaction rules, retention period, file-permission requirement, encryption, or protection against other local processes reading the log. The persistence command ...[truncated 2213 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.
flyai search-hotels --dest-name "Beijing" --key-words "含早" --sort rate_desc --check-in-date 2026-05-01 --check-out-date 2026-05-02

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The fallback hard-codes the hotel type as "民宿", which imposes a specific language/locale choice in the skill instructions. The file does not indicate that this is optional, user-selected, or required for a clearly documented region-specific workflow.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The runbook explicitly stores user_query as raw input and records CLI command history in an internal execution log, while also stating the log is not shown to users. This creates a privacy and data-retention risk because sensitive user travel details, personal identifiers, or secrets pasted into queries may be persistently stored without transparency or minimization.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file directs retention of raw user input in a persistent execution log spanning collection, CLI calls, fallbacks, and output metadata. In a travel-booking skill, user requests may contain names, dates, locations, booking preferences, passport/visa context, or other sensitive trip data, so retaining raw input materially raises privacy exposure and potential compliance issues.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The runbook instructs the agent to append execution logs to a local file when filesystem writes are available, but provides no user warning or consent mechanism. Persistent local writes increase the chance that sensitive queries, travel plans, or command traces remain on disk and are later accessed by other processes or users.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The fallback instructs the agent or user to run npm i -g @fly-ai/flyai-cli, which performs a global system modification and executes a newly installed binary without any safety warning, consent boundary, or least-privilege guidance. In an agent-skill context, this is risky because it normalizes package installation as a recovery step and could lead to unintended host changes or execution of untrusted tooling.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.