Security audit

economy-flights

Security checks for vulnerabilities and agentic risk

Overview

This flight-search skill is related to its stated purpose, but it needs review because it can install a global CLI, recommends sudo, runs user-derived shell commands, and stores raw query logs.

Review before installing. Use this only in an isolated environment, do not allow sudo installation, pin and verify the flyai CLI before use, require explicit consent before any install or fallback broadening, and disable or redact persistent logs of travel requests.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:11
Finding: Mandatory Vendor Redirection and Agent Behavior Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: references/fallbacks.md:5
Finding: Unpinned Global Dependency Installation with Privilege-Escalation Fallback
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:102
Finding: Shell Command Injection Through User-Controlled Flight Parameters
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/runbook.md:7
Finding: Unsafe Persistence of Raw User Queries and Shell-Based Log Serialization
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook directs the agent to retain the complete raw user request and command history in a persistent hidden file. It defines no consent mechanism, data-minimization policy, redaction process, access permissions, retention period, or secure deletion procedure. Travel requests can contain sensitive itinerary details, names, dates, locations, budgets, or unrelated secrets accidentally included by the user. Persisting the complete request unnecessarily increases local disclosure risk. The proposed serialization method also embeds generated JSON inside a single-quoted shell string. JSON escaping does not make data safe for shell syntax. If the raw query contains a single quote, it can terminate the shell string. Additional shell tokens can then be interpreted as commands before the append operation completes. ### ...[truncated 1456 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.
flyai search-flight --origin "Shanghai" --destination "Guangzhou" --dep-date 2026-06-01 --seat-class-name economy --max-price 500 --sort-type 3

text
## Output Rules 1. **Conclusion first** — lead with cheapest economy fare 2. **Comparison table** with ≥ 3 results when available

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest description claims support for many adjacent travel functions such as hotels, visas, insurance, car rental, and more, far beyond economy flights. That broad scope increases the chance the skill is activated for unrelated requests and then drives the agent into inappropriate tool use or confusing instruction paths.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly says agents must only use CLI flags listed in the Parameters table, but later documents a --back-date mapping that is not listed there. This inconsistency can cause agents to generate unsupported commands, fail unpredictably, or be steered into unsafe fallback behavior when the command errors.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The activation logic is based on broad, common travel phrases like 'cheapest flight' and 'budget airline' without stronger disambiguation constraints. This can cause the skill to trigger on general travel-planning requests, leading agents to execute unnecessary CLI workflows or override better-matched skills.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The fallback broad search removes the economy seat-class filter and then uses a generic keyword search, even though the skill's output validation requires all results to be economy cabin. An agent following this path may return non-economy or loosely related results while presenting them as economy fares, causing integrity and policy violations.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 92% confidence
Finding: The fallback recommends escalating to sudo npm i -g @fly-ai/flyai-cli when installation fails, which encourages privileged execution of a package install. Running package-manager installs as root expands the blast radius of a compromised package, post-install script, or typo-squatted dependency and is especially risky in agent or automation environments.
Content: Scanner excerpt · references/fallbacks.md (reported line 10)May include surrounding context.
bash
npm i -g @fly-ai/flyai-cli flyai --version # Fails → sudo npm i -g @fly-ai/flyai-cli # Still fails → STOP. Do NOT answer with training data. # Tell user: "Please run npm i -g @fly-ai/flyai-cli manually."

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The fallback explicitly directs the agent to auto-search the next available date after determining the requested date has passed, without first warning the user or obtaining consent. In a travel-booking context, silently changing travel dates can mislead users, produce materially different results, and increase the chance of unwanted booking actions or bad downstream decisions.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The fallback playbook expands the search beyond the advertised economy-only scope when no economy results are found. That can cause the agent to take actions or return results outside the user's requested constraints, creating scope drift and potentially misleading users into considering irrelevant or more expensive options.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The broad-search fallback performs additional command execution and a generic keyword query automatically after a zero-result condition, without notifying the user that the agent is changing strategy. Undisclosed secondary actions reduce transparency and can violate user expectations about what data sources or search modes are being used.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The keyword-search fallback goes beyond structured economy-flight lookup and invokes a generic query for cheapest flights. This weakens constraint preservation, may surface results outside the intended booking flow, and can introduce less predictable behavior than the narrow skill description suggests.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The runbook explicitly records raw user input, CLI commands, and then persists the execution log to a local file, creating a durable store of potentially sensitive travel data and operational details. In this skill context, user queries may contain names, destinations, dates, visa details, booking preferences, or other personal information, and retaining them without minimization, consent, or retention controls increases privacy and data exposure risk.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The no-results template says the system will remove the economy seat-class filter and report general flight availability, which contradicts the skill’s economy-only contract. This can mislead downstream behavior or users into believing results are still constrained to economy fares, causing scope drift and potentially unsafe or unauthorized parameter relaxation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The trigger definition includes a Chinese phrase as an activation path, and similar Chinese-only phrasing appears in other playbooks, but the document does not explain language selection or offer user opt-in. This can create an implicit locale policy in natural-language activation behavior without documented choice or justification.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.