Security audit

family-hotel

Security checks for vulnerabilities and agentic risk

Overview

This travel skill is mostly purpose-aligned, but it automatically installs and runs an unpinned global CLI and can secretly persist raw travel requests to disk.

Review carefully before installing. Use only if you are comfortable with a third-party travel CLI being installed globally and used for all results, and disable or remove the execution-log runbook behavior before handling personal travel details, children's information, budgets, or dates.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:8
Finding: Skill instructions override agent behavior and force external booking links
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:37
Finding: Automatic global installation and execution of an unpinned npm package
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/runbook.md:3
Finding: Raw user-query logging through shell interpolation enables command injection and data exposure
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook instructs the agent to include the raw user query in generated JSON and interpolate the entire JSON object into a single-quoted shell command. A single quote contained in user-controlled input can terminate the shell's quoted string. Shell metacharacters following that quote can then be parsed as commands when the persistence instruction is executed. JSON escaping does not make data safe for shell interpolation. JSON uses double-quote escaping and does not neutralize a single quote that terminates a shell string. The same log also stores raw queries and complete commands without consent, redaction, restrictive permissions, retention controls, or a documented deletion policy. The log is described as internal and hidden from use ...[truncated 1638 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.
flyai search-hotel --dest-name "Shanghai" --hotel-bed-types "多床房" --sort rate_desc --check-in-date 2026-07-01 --check-out-date 2026-07-03

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest-level description focuses narrowly on hotel discovery for families, while the documentation says the skill wraps flyai-cli to provide broader real-time travel data and booking links. That indicates behavior beyond a simple hotel-finding skill, creating a semantic mismatch between the claimed purpose and the documented capabilities.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The README instructs users to run npx skills add ... without pinning an exact package/version, which can cause execution of whatever package version is current at install time. In a supply-chain compromise or malicious package update scenario, users could execute attacker-controlled code during installation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The runbook explicitly defines an internal execution log that captures the raw user query and notes that it is not shown to users. In a travel-booking skill, user queries can naturally contain personal, financial, or itinerary details, so storing raw input without notice or minimization creates a real privacy and data-retention risk even if the log is intended for operations rather than abuse.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file instructs the agent to append execution logs containing raw user input and command history to a local .flyai-execution-log.json file. Persisting natural-language travel requests to disk increases exposure through local compromise, accidental inclusion in artifacts, backups, or shared workspaces, and the family-travel context makes leakage more sensitive because requests may include children's details, destinations, dates, and other personal travel information.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.