Security audit

family-trip

Security checks for vulnerabilities and agentic risk

Overview

This travel skill is provider-specific and disclosed, but it can auto-install an unpinned global CLI, force booking-link outputs, and persist sensitive travel queries in a hidden local log.

Review before installing. Use it only if you trust the flyai CLI and are comfortable sending travel queries to that provider, receiving provider booking links, and installing a global npm package. Prefer a pinned CLI version, require explicit approval before installation, and disable or redesign the execution log so raw prompts and command strings are not stored.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:8
Finding: Mandatory Commercial Output and Agent Instruction Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:126
Finding: Unpinned Global Package and Mutable Remote Dependency Execution
Content: View full analysis
Remediation: View remediation
`. 2. Verify package integrity using a lockfile, trusted checksum, signature, or equivalent provenance mechanism. 3. Pin repository-based installation instructions to an immutable commit hash rather than a branch or mutable path. 4. Avoid global package installation; use a project-local dependency or isolated execution environment. 5. Disable npm lifecycle scripts where compatible, or explicitly review every required lifecycle script. 6. Do not automatically install software merely because a command is missing. Request informed user approval first. 7. Run the CLI with minimum filesystem, environment, and network privileges. 8. Document the package publisher, expected digest, supported version, and update-review process. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: references/runbook.md:33
Finding: Shell Command Injection Through Raw User Query Logging
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook places raw user input into `generation_log_json` and then embeds the generated value inside a single-quoted shell string. JSON string escaping does not provide shell escaping. In particular, an apostrophe in attacker-controlled input can terminate the shell's single-quoted context. Shell metacharacters following that apostrophe may then be interpreted as commands. The same issue can arise through any other attacker-influenced log field included in the serialized object. Appending the value with `echo` does not safely parameterize the data; it asks a shell to parse a command containing the data. ### Attack Path 1. An attacker submits a travel request containing an apostrophe followed by shell syntax. 2. The complete request is assigned to the `user_query` field as raw input. 3. The agent serializes ...[truncated 1231 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/runbook.md:1
Finding: Unconsented Persistent Storage of Raw User Queries
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook instructs the agent to retain each complete user query in a hidden, append-only local file. It explicitly states that the internal log is not shown to users, but it does not require notice, consent, redaction, encryption, restrictive permissions, a retention period, or secure deletion. Family-travel queries can contain personal and security-sensitive information, including names, travel dates, home or departure locations, destinations, family composition, children's details, budgets, and planned absences from home. Persisting the full raw prompt is unnecessary for basic operational telemetry. The filename begins with a dot, reducing normal visibility, but this does not provide access control or confidentiality. ### Attack Path 1. A user provides family and itinerary details in a travel request. 2. The skill creates a runbook entry containing the complete request under `user_query`. 3. If filesystem writes are available, the entry is appended to `.flyai-execution-log.json`. 4. Additional requests accumulate in the same file without a documented retention limit. 5. Another local user, process, backup system, synchronization service, or accidental repository commit exposes the stored records. ### Impact Ass ...[truncated 521 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 198)May include surrounding context.
Full family orchestration

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The README instructs users to run npx skills add ... without pinning a specific version, which can cause execution of whatever package version is current at install time. If the referenced package or one of its dependencies is compromised upstream, users may unknowingly execute malicious code during installation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The runbook explicitly stores raw user input, CLI commands, and operational metadata in an internal execution log, and recommends appending that log to a persistent local file. In a travel-booking skill, user queries can contain names, destinations, dates, passport/visa details, booking references, and other sensitive travel information, so retaining it without minimization or retention controls creates a meaningful privacy and data-exposure risk.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The schema includes a user_query field populated with the raw input and states that the log is maintained internally, which means potentially sensitive user-provided content is retained beyond immediate processing. Because this skill handles family travel planning and bookings, the raw query may include children-related details, locations, schedules, or identity-related travel data that should not be persistently stored in full.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The rules require logging every CLI command and persisting the execution log, which can capture secrets in arguments, booking tokens, API parameters, local paths, and internal operational details. Persisting this data increases the blast radius of any local compromise, misconfiguration, or unauthorized access to the log file.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README advertises real-time travel data and booking links but does not clearly disclose that using the skill may contact external services and share user travel queries with third parties. In a travel-booking context, prompts may contain sensitive itinerary, family, or location details, so lack of notice can lead to unintended data exposure and weak user consent.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.