Security audit

explore-australia

Security checks for vulnerabilities and agentic risk

Overview

This flight-search skill is not clearly malicious, but it should be reviewed because it tells agents to globally install and run an unpinned third-party CLI automatically.

Review before installing. Use it only if you trust the flyai/Fliggy-backed CLI and are comfortable sharing travel search details with that provider. Do not allow automatic global npm installation; prefer a pinned, local, or sandboxed install that you approve first, and verify booking links, currency, and prices before purchase.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The skill explicitly says agents must only use parameters listed in the Parameters table, but later instructs use of `--journey-type 1`, which is not documented there. This inconsistency can cause agents to invoke unsupported or unintended CLI behavior, undermining the safety constraint that parameters be tightly controlled.

Intent-Code Divergence

Low

Confidence: 92% confidence
Finding: The output template brands results as 'Powered by flyai' even though the skill metadata says the provider is Fliggy (Alibaba Group). In a travel-booking workflow, conflicting provider identity can mislead users about the source of pricing and booking links, reducing trust and potentially enabling phishing-style redirection or deceptive affiliate behavior.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill mandates automatic installation of a global package (`npm i -g @fly-ai/flyai-cli`) when the tool is missing, without requiring user consent or validating package provenance. In an agent context, this enables unreviewed code execution and system modification on the host, which is risky even if the package is legitimate.

Missing User Warnings

Low

Confidence: 94% confidence
Finding: The file instructs operators to run a global npm installation command, which modifies the host system and may execute package install scripts without any warning, consent step, or safer alternative. In an agent skill context, operational docs can influence automated or semi-automated recovery behavior, so this creates avoidable supply-chain and system-modification risk even if the intent is only to restore functionality.

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The trigger terms for the Cheapest Option playbook include very broad words like "cheap" and "budget", which can appear in many travel-related queries without the user explicitly requesting cheapest-flight behavior. This can cause the wrong playbook to execute and bias results toward low-cost options, potentially ignoring user preferences such as convenience, timing, or fewer stops.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The Fastest Route playbook uses broad triggers such as "fast" and "quick", which are ambiguous and may refer to booking speed, response speed, or general urgency rather than shortest flight duration. This can unintentionally invoke a fastest-route search and return suboptimal or more expensive itineraries that do not match the user's actual intent.

Natural-Language Policy Violations

Medium

Confidence: 80% confidence
Finding: Mandating CNY pricing regardless of user locale or preference can misrepresent costs and create confusion during travel booking, especially for international users booking Australian travel. While not a direct code-execution issue, it can cause users to make incorrect purchase decisions if exchange rates, settlement currency, or local fees differ from the displayed amount.

Static analysis

No suspicious patterns detected.