Security audit

Fall Foliage

Security checks for vulnerabilities and agentic risk

Overview

This travel skill is mostly coherent, but it automatically installs an unpinned global CLI package and can persist raw user travel queries without consent or retention controls.

Review carefully before installing. Only use this skill if you are comfortable installing the flyai CLI globally and receiving provider-filtered results with booking links. Avoid entering passport, payment, account, or other sensitive travel details unless logging is disabled or clearly controlled.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Note

Location: SKILL.md:10
Finding: Forced Commercial Output and Agent Behavior Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:45
Finding: Unpinned Global Installation of a Third-Party npm Package
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: references/runbook.md:5
Finding: Unsafe Persistent Logging of Raw User Queries
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook instructs the agent to retain the complete raw user query, timestamps, commands, collected parameters, and execution metadata in `.flyai-execution-log.json`. It provides no user-consent mechanism, sensitive-data redaction, retention period, access-control requirement, encryption, or deletion procedure. The persistence command also embeds generated JSON into a shell command. If the implementation performs direct textual substitution, single quotes or shell syntax derived from a user query can terminate the quoted argument and alter shell parsing. The documentation does not require structured serialization or robust shell escaping. The audit confirms the unsafe pattern in the instructions. Whet ...[truncated 1836 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.
flyai search-poi --city-name "Kyoto" --keyword "红叶"

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest description says the skill also supports flight booking, hotel reservation, train tickets, attraction tickets, itinerary planning, visa info, travel insurance, car rental, and more. In this file, the only concrete executable commands shown are flyai search-poi queries for foliage-related POIs, and no actual workflows or parameters for the broader travel services are defined here.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill instructs the agent to automatically install a global npm package (npm i -g @fly-ai/flyai-cli) as part of normal execution, without explicit user consent or trust verification. In an agent context, this expands the attack surface by allowing unreviewed code execution and system modification, which is especially risky because package installation scripts can execute arbitrary code.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The trigger phrase "autumn leaves in China" is broad enough to match many ordinary travel-planning requests, which can cause this playbook to activate unintentionally. Because the playbook issues a destination-specific POI search based on a generic seasonal query, users may receive tool-driven behavior or narrowed results they did not explicitly request.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrase "ginkgo trees" is highly generic and likely to overlap with casual questions about trees, botany, photography, or local landmarks. In a travel skill that can perform downstream booking and search actions, such unintended activation increases the risk of irrelevant tool use and misrouting the user's request into a travel workflow.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The runbook explicitly captures raw user input in user_query and defines a persistence mechanism to append execution logs to a local file, but provides no minimization, redaction, retention, or consent controls. In a travel skill, users may submit passport details, visa data, contact information, booking preferences, or other sensitive travel-related content, so storing raw prompts materially increases privacy and data leakage risk.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The schema requires detailed logging of commands, fallbacks, output characteristics, and risk flags, and the persistence example writes the full generated log to .flyai-execution-log.json. This creates a natural-language data exposure path because operational logs can accumulate sensitive user content and booking-related context, and may later be accessed by other processes, operators, or downstream tooling without the user's awareness.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The section is under 'Execute CLI Commands' and presents 'Playbook A: Kyoto Autumn' as an executable workflow, but the fenced block contains prose ('Flight to Japan (Nov) + Kyoto hotel + maple temple POIs') instead of a real command. This contradicts the file's repeated instruction that all data must come from actual flyai CLI execution and that parameters must not be invented.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.