Security audit

family-trip

Security checks for vulnerabilities and agentic risk

Overview

This family travel skill is coherent, but it needs Review because it can auto-install a global CLI and silently save raw travel requests locally.

Install only if you trust the flyai npm package and are comfortable with travel searches being sent to the provider for real-time results. Require explicit approval before any global npm install, and disable or delete `.flyai-execution-log.json` if you do not want family travel details saved locally.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The README states that the skill provides real-time travel data and booking links, which implies outbound network access and possible transmission of user travel queries or booking-related information to external services. Failing to disclose this behavior can mislead users and integrators about privacy, data flow, and trust boundaries, especially in agent environments where tool/network use may be assumed to be local unless documented.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill explicitly instructs the agent to install a global npm package if the CLI is missing, which modifies the host environment without prior user consent or a safety warning. In an agent setting, automatic package installation expands the attack surface to supply-chain risk and persistent system changes beyond the user's original travel-planning request.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The prerequisites section normalizes a global install as a default setup step but does not disclose that it changes the system state. Even if framed as preparation, this can cause an agent to perform non-read-only actions automatically and expose the environment to unreviewed third-party code execution.

Missing User Warnings

Medium

Confidence: 99% confidence
Finding: This workflow is more dangerous than a passive prerequisite because it directs the agent to automatically install software when `flyai` is absent, with no confirmation gate. That creates a clear path for autonomous environment modification and potential supply-chain compromise during normal task execution.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The runbook explicitly logs `user_query` as raw input in an internal execution log, creating unnecessary retention of potentially sensitive travel data such as names, locations, dates, children-related details, or booking context. Because the skill is family-travel focused, users may disclose especially sensitive itinerary and child-safety information, making undisclosed raw-input logging more privacy-invasive and increasing downstream exposure if logs are accessed, persisted, or reused.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The runbook instructs appending execution logs to a local file, which creates persistent storage of operational and potentially sensitive user-derived data without notice or consent. This increases the blast radius from transient telemetry to durable local artifacts that may be readable by other processes, accidentally committed, backed up, or left behind on shared systems.

Static analysis

No suspicious patterns detected.