Security audit

extended-stay

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real travel-search wrapper, but it asks agents to install and run an unpinned global CLI and persist raw travel queries without enough user control or disclosure.

Review before installing. Only use this skill if you trust the flyai CLI supply chain, are comfortable with provider booking links and branding, and can prevent automatic global npm installs and raw-query log persistence unless explicitly approved and redacted.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:8
Finding: Mandatory Agent Role and Commercial Output Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:38
Finding: Automatic Installation and Execution of Unpinned Third-Party Packages
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:92
Finding: Shell Command Injection Through Interpolated Travel Parameters
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/runbook.md:1
Finding: Plaintext Raw-Query Logging With a Shell-Injection Sink
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook instructs the Agent to retain the raw user query, collected parameters, complete CLI commands, fallback commands, and execution metadata in `.flyai-execution-log.json`. No consent mechanism, data minimization, redaction policy, retention limit, file-permission requirement, or deletion procedure is specified. Travel queries may contain personal itinerary details, dates, destinations, accommodation preferences, or other sensitive free-form ...[truncated 2097 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.
flyai search-hotel --dest-name "Shanghai" --key-words "长租" --sort price_asc --check-in-date 2026-05-01 --check-out-date 2026-06-01

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The README instructs users to run npx skills add alibaba-flyai/flyai-skill/tree/main/skills/long-stay-hotel, which relies on an unpinned remote package/toolchain and a mutable main branch reference. This creates a supply-chain risk: future changes to the package or repository content could cause users to fetch and execute unintended code or install altered skill content without review.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly instructs the agent to install a global npm package (npm i -g @fly-ai/flyai-cli) as part of normal execution, and even says installation is mandatory if the binary is missing. That causes a system-modifying action without prior user confirmation, expands the trusted codebase at runtime, and can expose users to supply-chain risk if the package is compromised or unexpected in the current environment.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Line L25 specifies the hotel type as the Chinese term "民宿". This imposes a specific language/locale in the skill content without any user opt-in or documented region-specific justification, which matches the language/locale policy violation category.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The runbook explicitly records user_query as raw input in an internal execution log, which can capture sensitive personal, financial, travel, or identity data users may provide during booking-related interactions. Because the document says the log is not shown to users and provides no notice, minimization, or redaction guidance, this creates a privacy and data-handling vulnerability rather than a harmless implementation detail.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The runbook instructs the agent to append execution logs to a local file, creating persistent storage of request metadata and potentially sensitive query contents without any retention limit, protection requirements, or user disclosure. In a travel skill context, those logs may include itineraries, visa-related details, names, dates, or other personal data, increasing the risk of unauthorized access or over-retention.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The trigger list mixes English and Chinese and explicitly includes a Chinese-only trigger term, but the file does not state that the skill is region-specific or that users may choose their preferred language. Under the policy, forcing or privileging a specific language without opt-in can be a natural-language policy concern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.