Security audit

Explore Tibet

Security checks for vulnerabilities and agentic risk

Overview

This travel skill is mostly aligned with Tibet trip planning, but it asks the agent to install a global package automatically and persist raw user queries in a local log without clear user notice or safeguards.

Review before installing. The travel-search behavior and booking links are expected for this skill, but installation should not auto-run a global npm package without approval, and any logging should be disabled or changed to redact raw travel details and use a safe file-writing method.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:8
Finding: Agent Role and Commercial Output Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:125
Finding: Automatic Installation of an Unpinned Global npm Package
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/runbook.md:1
Finding: Undisclosed Plaintext Persistence of Raw User Queries
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook instructs the agent to retain the complete raw user input, collected parameters, commands, timestamps, fallback actions, and output metadata. It explicitly states that this logging is not shown to users. Travel requests can contain personal or sensitive information, including names, dates, origin and destination locations, lodging preferences, budgets, ...[truncated 1273 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/runbook.md:35
Finding: Shell Command Injection Through Interpolated JSON Logging
Content: View full analysis
> .flyai-execution-log.json ``` ``` The interpolated object is defined to include raw input: ```json { "request_id": "{uuid}", "skill": "{skill-name}", "timestamp": "{ISO-8601}", "user_query": "{raw input}", "steps": [ { "step": 0, "action": "env_check", "command": "flyai --version", "status": "pass | fail" } ] } ``` ### Technical Analysis The logging instruction places generated JSON inside a single-quoted shell string. The generated object includes the user's raw prompt and potentially other user-derived parameters. JSON escaping does not make content safe for shell interpolation because JSON and shell quoting use different grammars. A single quote inside the raw input can terminate the shell's quoted string. The remaining input can then introduce shell separators, substitutions, redirections, or commands. If an agent implements the documented command literally, attacker-controlled prompt text can cross the data-to-command boundary. The finding is based on the prescribed command construction. Whether exploitation occurs in a particular host depends on whether that host executes the template through a shell exactly as documented. ### Attack Path 1. An attacker submits a query containing a single quote followed by shell syntax. 2. The complete query is copied into `generation_log_json` as `user_query`. 3. The agent substitutes the generated JSON into: `echo '{generation_log_json}' >> .flyai-execution-log.json` 4. The attacker's quote terminates the intended shell string. 5. Injected shell syntax is parsed and executed by the command interpreter. 6. The injected process runs with the same privil ...[truncated 522 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 198)May include surrounding context.
flyai search-flight --origin "Chengdu" --destination "Lhasa" --dep-date 2026-06-01 --sort-type 3

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill's 'CRITICAL EXECUTION RULES' push the agent to install a global npm package automatically, without user confirmation or warning that this changes the host environment. Installing and executing a package from a registry expands the trust boundary to third-party code and can lead to unintended code execution or persistent system modification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The prerequisites section instructs a global install (npm i -g) without warning that it alters the system and runs untrusted package lifecycle code. In an agentic context, this can cause silent environment changes and expose users to supply-chain risk if the package or one of its dependencies is compromised.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The workflow explicitly directs the agent to run a global npm installation automatically when flyai is missing, then immediately execute the newly installed binary. This creates a clear path for unreviewed remote code execution and persistent host modification without user approval, which is especially risky in autonomous or semi-autonomous agent environments.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger phrase "Tibet trip" is broad enough to match many ordinary travel queries without clear user intent to invoke this exact playbook. In an agent setting, ambiguous activation can cause the system to run the wrong booking/planning flow, leading to unintended actions, incorrect parameter mapping, or overcollection of travel preferences.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The trigger phrase "complete Tibet" lacks clear activation boundaries and may be interpreted inconsistently across similar travel-planning requests. This increases the risk that the full multi-day itinerary flow is selected when the user intended a narrower query, which is especially problematic in a skill tied to flights, hotels, tickets, and itinerary generation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The runbook explicitly records user_query as raw input in an internal execution log, which can capture sensitive personal, financial, travel, or identity data users may provide while booking flights, hotels, visas, or insurance. Because the log is described as internal and not shown to users, this creates undisclosed data retention and privacy risk, especially in a travel-booking context where sensitive information is likely.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The runbook combines retention of raw user_query with instructions to persist the execution log, creating a durable record of potentially sensitive travel and booking conversations. In this skill's context, users may submit passport, visa, itinerary, payment-adjacent, or insurance details, so storing full inputs materially increases privacy, compliance, and secondary exposure risks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The runbook instructs persistent appending of execution logs to a local file, which can accumulate operational metadata and user-derived content over time without any notice, retention policy, or protection requirements. Persistent local storage increases the blast radius of compromise because sensitive queries, commands, and recovery actions may be exposed to other processes, operators, or future exfiltration.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill repeatedly requires every result to include a booking link derived from detailUrl (for example L014 and L186), but L203 says both 'Use detailUrl for booking links' and 'Never use detailUrl' in the same rule. This is an active contradiction in the documentation that can mislead an agent about the intended output behavior.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.