Security audit

fishing-trip

Security checks for vulnerabilities and agentic risk

Overview

This travel skill is not clearly malicious, but it requires a broad third-party CLI workflow with automatic global installation and unsafe command templates that users should review carefully before installing.

Review before installing. This skill may install a global npm package, run a third-party travel CLI, send travel search details to that provider, and produce mandatory booking links. It should only be used in an environment where global package installation and external booking-provider results are acceptable, and safer versions should require explicit install approval, pinned package versions, input validation, and non-shell argument execution.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:10
Finding: Mandatory Third-Party CLI and Commercial Output Instructions Hijack Agent Behavior
Content: View full analysis
Chinese output. English input -> English output. 5. **NEVER invent CLI parameters.** Only use parameters listed in the Parameters Table below. If a flag is not listed, it does not exist. **Self-test:** If your response contains no `[Book](...)` links, you violated this skill. Stop and re-execute. ``` Related output-enforcement instructions also occur at `SKILL.md:119-135` and `references/templates.md:25-37`, including the mandatory provider branding and booking links. ### Technical Analysis The skill declares identity-level instructions that redefine the agent as a CLI executor and prohibit normal response behavior. It then requires every result to contain a third-party booking link and directs the agent to repeat execution when that requirement is not met. These instructions do more than describe the legitimate mechanics of a travel search. They impose persistent commercial output requirements on the current session and force use of one specific external provider. Because `detailUrl` values originate from the CLI response, the external provider can influence the destinations to which users are redirected. The self-test acts as an enforcement loop: even when a useful answer could be supplied without a commercial link, the agent is instructed to reject that answer and run the external workflow again. ### Attack Path 1. A user ...[truncated 1156 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:62
Finding: Automatic Global Installation of an Unpinned npm Package
Content: View full analysis
proceed to Step 1 - FAIL: `command not found` -> ```bash npm i -g @fly-ai/flyai-cli flyai --version ``` ``` The same installation command is repeated in `references/fallbacks.md:3-9` and `references/fallbacks.md:20-24`. ### Technical Analysis The skill instructs the agent to install the latest available version of `@fly-ai/flyai-cli` globally when the command is absent. The dependency is not pinned to an audited version, and no package digest, provenance check, signature verification, or package-content review is required. An npm installation may execute package lifecycle scripts. A global installation also makes package-provided executables available beyond the project directory and may modify globally shared package state. The code that is ultimately executed can therefore change after the skill itself has been reviewed. This is a supply-chain exposure even without evidence that the current package is malicious: compromise of the publisher account, package registry, dependency tree, or a future package release could turn the mandated installation into arbitrary code execution. ### Attack Path 1. The skill checks for `flyai` with `flyai --version`. 2. The command is absent from the environment. 3. The mandatory fallback invokes `npm i -g @fly-ai/flyai-cli`. 4. npm resolves the current package release and transitive dependencies from the registry. 5. Package installation code or lifecycle scripts execute with the permissions of the agent process. 6. The newly installed executable is then invoked for subsequent user queries. 7. If the package or a dependency has been compromised, attacker-controlled code executes locally. ### Impact Assessment A compromis ...[truncated 683 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:83
Finding: User-Controlled Travel Parameters Are Interpolated into Shell Commands
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.
flyai search-flight --origin "Beijing" --destination "Shanghai" --dep-date 2026-05-15 --sort-type 2

text
## Output Rules 1. **Conclusion first** — lead with best option 2. **Fishing tip — Zhoushan, Hainan, and Maldives are top fishing spots**

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly states that agents must never invent CLI parameters and may only use flags listed in the parameter table, but the Direct Route playbook later uses --journey-type 1, which is undocumented. This inconsistency can cause agents to execute unsupported or unintended commands, weakening guardrails around tool usage and increasing the chance of command misuse or failure-prone behavior.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The activation trigger includes broad phrases such as plan a trip and Chinese equivalents for general travel planning, which can match many ordinary travel requests unrelated to fishing. That overbreadth can cause this skill to activate outside its intended scope and steer agents into installing or invoking a travel-booking CLI unnecessarily, expanding the attack surface and overriding more appropriate skills.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The triggers "cheap", "budget", "fast", and "quick" are generic adjectives rather than flight-specific activation phrases. In a markdown playbook, this ambiguity can cause unintended invocation because the file does not constrain these phrases to flight-search contexts or provide exclusion examples.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The trigger "0 results from above playbooks" describes an internal condition, but the file does not specify how that condition is detected or whether user confirmation is needed before expanding the search. This lack of specificity can lead to inconsistent or unintended fallback behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The instruction to always format prices in CNY forces a specific locale/currency presentation in natural language output. The file does not offer user opt-in or explain that the skill is limited to a China-specific context, so this is a language/locale policy concern.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The exclusion rule Do NOT activate for: general outdoor → nature-spots is too narrow and ambiguous to meaningfully constrain activation. Because the negative scope is underspecified, the skill may still trigger for many non-fishing travel scenarios and cause unintended CLI execution behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The fallback guidance states 'use Chinese or English city names,' which constrains language choice in natural-language instructions. This is a locale/language restriction without any opt-in, alternatives, or justification that the skill is region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: Including fixed locale-specific trigger phrases like "钓鱼航班", "最便宜", and similar Chinese terms can reflect a language policy choice, but the file does not state whether multilingual triggering is optional or user-configurable. Under the policy rule, forcing or assuming specific languages without opt-in can be a natural-language policy concern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.