Security audit

Budget Backpacker

Security checks for vulnerabilities and agentic risk

Overview

This travel skill is purpose-related but should go to Review because it can automatically install and run a global third-party booking CLI, force commercial booking links, and persist raw trip queries locally.

Install only if you are comfortable with a third-party flyai/Fliggy CLI being installed globally and used as the exclusive source for travel results. Avoid entering passport details, full names, credentials, or other sensitive information unless logging is removed or clearly controlled; prefer a pinned, reviewed, local install and disable raw-query persistence.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:10
Finding: Forced Commercial Output and Agent Behavior Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:127
Finding: Automatic Installation of an Unpinned Global npm Dependency
Content: View full analysis
Remediation: View remediation
`. 2. Verify the package using a trusted integrity digest, lockfile, or signed provenance before execution. 3. Review the package's lifecycle scripts and transitive dependencies. 4. Avoid global installation. Install into a project-local, isolated directory or disposable sandbox. 5. Use npm controls such as `--ignore-scripts` during installation unless lifecycle scripts are explicitly required and audited. 6. Require explicit user approval before installing third-party software. 7. Run the CLI with restricted filesystem, environment, and network permissions. 8. Fail safely when the dependency is missing rather than making automatic installation mandatory. 9. Document the expected publisher, registry, version, checksum, and security-review process. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: references/runbook.md:8
Finding: Plaintext Persistence of Raw User Queries and Unsafe Shell-Based Log Serialization
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook directs the agent to include the complete raw user input in an internal execution log and append that data to `.flyai-execution-log.json`. Travel requests can contain sensitive information such as names, destinations, dates, budget constraints, accommodation plans, or other personal itinerary details. No consent mechanism, data minimization, redaction, file permission, encryption, retention limit, deletion procedure, or secure storage location is specified. The log also records commands and recovery commands, which could expose additional user-provided values. The persistence example serializes generated JSON by interpolating it into a shell command enclosed in single quotes. If an implementation substitutes raw content without robust shell escaping, a single quote in t ...[truncated 2000 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill instructs the agent to install software globally with npm if the CLI is missing, but the user-facing description does not clearly disclose that system modification may occur. This is dangerous because users may invoke a seemingly informational travel skill without realizing it can execute package installation commands, expanding trust and supply-chain risk.
Content: No source excerpt is available for this finding.

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 198)May include surrounding context.
Budget multi-city orchestration

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The activation logic is overly broad for a travel skill and can trigger on ordinary travel-related requests, causing the agent to invoke this skill outside the user's likely intent. Because this skill's workflow includes mandatory CLI execution and potential package installation, accidental activation increases the chance of unnecessary command execution on the host.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The instruction 'never answer without executing' removes a safe non-executing response mode and pressures the agent to invoke tools even when the user may only want advice, clarification, or high-level information. Because this skill supports transactional travel operations like flights, hotels, trains, and tickets, execution-only behavior raises the risk of unintended tool use, premature booking flows, and reduced opportunity for user confirmation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger phrase uses an unconstrained placeholder ('{region}'), which can cause overly broad matching and unintended invocation for loosely related user inputs. In an action-capable travel skill, ambiguous triggering increases the chance the agent enters an execution flow and performs booking/search behavior when the user only intended general discussion or partial planning.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The runbook explicitly records user_query as raw input and appends the full execution log to a local file, creating unnecessary retention of potentially sensitive natural-language data. In a travel/booking skill, users may include passport details, names, dates, locations, budget, visa questions, and other personal information, so persistent plaintext logging increases privacy exposure and leak risk.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Persisting raw free-form user queries to .flyai-execution-log.json creates a durable local record that may contain secrets or personal travel data and can be exposed through local compromise, backups, support bundles, or accidental sharing. Because this skill supports bookings and travel planning, the data category is more sensitive than generic chat content, making the retention risk more significant in context.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.