Security audit

Explore Korea

Security checks for vulnerabilities and agentic risk

Overview

This Korea travel skill has a coherent travel-booking purpose, but it requires broad command execution, unapproved global package installation, and hidden local logging of raw user queries.

Install only if you are comfortable with a Korea travel skill that may run a third-party flyai CLI, install it globally through npm if missing, send travel queries to that provider, add booking links/branding, and write local execution logs. Prefer manual review and installation of a pinned CLI version, and avoid entering sensitive personal, passport, payment, or private itinerary details unless logging and data handling are fixed.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:8
Finding: Mandatory Commercial Output and Agent Behavior Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:112
Finding: Unpinned Global Installation of a Third-Party npm Package
Content: View full analysis
Remediation: View remediation
`. 2. Verify package integrity using a lockfile and expected registry integrity digest. 3. Verify package provenance, publisher identity, and release signatures where supported. 4. Do not install the package globally. Use a project-local dependency or an isolated disposable environment. 5. Require explicit user approval before installing any package. 6. Avoid administrative execution and document the minimum required privileges. 7. Disable lifecycle scripts with `--ignore-scripts` unless an audited installation step demonstrably requires them. 8. Audit the resolved package and all transitive dependencies before deployment. 9. Prefer invoking a fixed local executable path rather than trusting a globally resolved command from `PATH`. 10. Define an update and re-audit process so package upgrades cannot occur silently. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: references/runbook.md:32
Finding: Shell Injection and Sensitive Query Exposure in Execution Logging
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook directs the Agent to include `{raw input}` in a generated JSON record and then embed the entire record inside a single-quoted shell argument. No escaping or safe serialization procedure is specified. A single quote contained in the raw user query can terminate the shell's quoted string. Subsequent characters may then be interpreted as shell operators or commands. JSON escaping alone does not safely escape content for a shell command because JSON and shell quoting use different grammars. For example, if implemented literally, a query containing a payload shaped like: ```text '; attacker_command; printf ' ``` could terminate the argument passed to `echo`, introduce a new command, and then reopen quoting so the remainder remains syntacti ...[truncated 2097 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 198)May include surrounding context.
flyai search-flight --origin "Beijing" --destination "Seoul" --dep-date 2026-05-01 --sort-type 3

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill's critical execution rules instruct the agent to install flyai-cli if it is missing, which can modify the host environment without informed user consent. Because this is positioned as mandatory behavior, a simple travel query could trigger third-party software installation and network retrieval of code, creating supply-chain and system-integrity risk.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The activation triggers are broad enough to fire on ordinary mentions of Korea-related travel, which can cause the agent to invoke this skill unexpectedly. In this skill, accidental activation is more dangerous because the workflow then mandates environment checks and possible CLI installation, potentially leading to unprompted external command execution and network access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The prerequisites section explicitly includes a global npm installation command for third-party software, again without warning about system changes or requiring user approval. Global installs can alter PATH-resolved executables and introduce unreviewed code into the environment, making this unsafe in an agent-execution context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document states that the execution log is internal and not shown to users while the schema captures raw input in user_query. Collecting and potentially retaining raw user input without any user-facing notice or consent is a privacy weakness, especially in a travel context where users may share names, dates, destinations, passport or visa-related details.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The runbook explicitly requires storing the raw user query along with detailed step-by-step execution metadata, including commands, statuses, and latency. For a travel-planning skill, this exceeds what is necessary to fulfill the feature set and can expose sensitive travel plans, personal details, or booking-related information if retained or accessed improperly.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The runbook instructs the agent to append execution logs to a local file, creating persistent storage of sensitive operational and user-derived data without any demonstrated business need for this travel skill. Persistent filesystem logging increases the blast radius of compromise by making data available beyond the immediate session and potentially accessible to other processes, operators, or later misuse.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Line L203 says both 'Use detailUrl for booking links' and 'Never use detailUrl' in the same instruction. This is an active contradiction in the skill documentation that can mislead the agent about whether to include the required booking URL field.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 71% confidence
Finding: The file says the agent's execution log is not shown to users, yet Rule 5 requires risk_flags to be rendered in user-facing output. This creates a natural-language policy inconsistency around what operational or safety information is disclosed to users.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.