Security audit

fishing-trip

Security checks for vulnerabilities and agentic risk

Overview

This travel-search skill is not malicious, but it tells agents to automatically install and run a global third-party CLI for broadly scoped travel requests.

Install only if you are comfortable with an agent installing a global npm package and sending travel-search details to FlyAI/Fliggy. Review the exact command before allowing installation, and use this skill only for explicit flight or fishing-trip planning requests.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The activation trigger includes the broad phrase `plan a trip`, which overlaps with many generic travel requests unrelated to fishing. That can cause the skill to activate unexpectedly, leading the agent to run external CLI commands, collect extra parameters, and potentially transmit user travel data to a third-party service when the user did not intend to use this skill.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs the agent to install a global npm package (`npm i -g @fly-ai/flyai-cli`) and execute it if missing, without warning the user that this modifies the host system. Auto-installing and running external code expands the trust boundary, can alter the environment persistently, and may expose the system to supply-chain or execution risks without informed consent.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill is designed to send user-supplied travel search details through an external CLI to a flight service, but it does not provide a user-facing privacy or data-transfer warning. This is dangerous because location, itinerary, and date information may be transmitted off-platform without explicit consent or visibility, creating privacy and compliance risk.

Missing User Warnings

Low

Confidence: 94% confidence
Finding: The document instructs the operator to run a global npm installation command that modifies the host environment, but it provides no warning, consent checkpoint, or guidance about the risks of installing third-party software globally. In an agent-skill context, this is dangerous because operators may follow recovery steps reflexively, expanding the trusted computing base and potentially installing unreviewed code with elevated impact on the system.

Missing User Warnings

Low

Confidence: 95% confidence
Finding: This fallback repeats the global CLI installation command without any safety notice, reinforcing unsafe operational behavior and increasing the chance that an operator executes a system-modifying command automatically. Although not overtly malicious, repeated unaudited install instructions in recovery guidance can normalize unsafe changes to the host and create supply-chain exposure if the package or registry is compromised.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger phrases "cheap" and "budget" are generic terms that commonly appear in ordinary travel conversations, so this playbook can be invoked when the user did not specifically ask for the cheapest-flight optimization. In a booking skill, this can silently bias results toward low-cost options and lead to mismatched recommendations or bookings that do not reflect user intent.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The triggers "fast" and "quick" are vague and can refer to response speed, booking speed, or general urgency rather than the fastest route by travel duration. In this travel context, that ambiguity can cause the system to optimize for shortest itinerary unexpectedly, potentially surfacing more expensive or otherwise unsuitable options.

Static analysis

No suspicious patterns detected.