ClawHub
Back to skill

Security audit

cycling-trip

Security checks across malware telemetry and agentic risk

Overview

This travel-planning skill is not clearly malicious, but it tells agents to install and run a global third-party CLI automatically, which can modify the user's system without clear consent.

Install only if you are comfortable with an agent using the FlyAI CLI for live travel results and booking links. Before use, install any CLI dependency yourself in a controlled environment, avoid automatic global npm installs, and verify generated booking links and prices directly with the provider before purchasing.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The skill explicitly says agents must only use CLI flags listed in the Parameters table, but the Direct Route playbook uses `--journey-type 1`, which is not declared there. This mismatch can cause agents to either invent unsupported parameters or ignore the documented safety boundary, increasing the chance of command misuse and unpredictable execution behavior.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The fallback instructions tell the agent/operator to install a global npm package and depend on a local CLI in order to continue. That expands the skill's effective capabilities from travel booking into system modification and software installation, which is not clearly justified by the user-facing purpose and creates supply-chain and environment-tampering risk if followed in an automated agent context.

Vague Triggers

Medium
Confidence
88% confidence
Finding
Using the broad trigger phrase `plan a trip` can cause this skill to activate for many generic travel requests outside its stated cycling-flight niche. That scope collision can route unrelated user queries into a workflow that executes commands, installs software, and returns booking-oriented results the user did not intend.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The manifest description advertises broad services like hotels, trains, insurance, visas, and car rental even though the body primarily defines a flight-search workflow. This unclear scope can lead orchestrators or users to invoke the skill for unsupported tasks, causing overreach, wrong-tool execution, or unsafe fallback behavior.

Missing User Warnings

High
Confidence
98% confidence
Finding
The skill instructs the agent to automatically run `npm i -g @fly-ai/flyai-cli` if the tool is missing, without asking the user for consent or warning about system modification. Automatic global package installation is a high-risk behavior because it changes the host environment, may execute lifecycle scripts, and could introduce supply-chain compromise or policy violations.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.