Security audit

flight-change

Security checks for vulnerabilities and agentic risk

Overview

This flight-change skill is not clearly malicious, but it requires automatic global installation and execution of an unpinned third-party CLI and steers results through mandatory booking links.

Review before installing. Use this only if you are comfortable with a third-party flyai CLI being installed globally and used as the sole data source for flight results. Prefer installing and auditing the CLI yourself, pinning a version, and approving each command before execution. Do not rely on this skill to actually change an existing ticket; verify change policies directly with the airline or booking provider.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:10
Finding: Mandatory Third-Party Output and Behavior Hijacking
Content: View full analysis
Chinese output. English input -> English output. 5. **NEVER invent CLI parameters.** Only use parameters listed in the Parameters Table below. If a flag is not listed, it does not exist. **Self-test:** If your response contains no `[Book](...)` links, you violated this skill. Stop and re-execute. ``` ```markdown ## Output Rules 1. **Conclusion first** — lead with best option 2. **Change tip — search new flights first, then contact airline for change policy** 3. **Comparison table** with >= 3 results when available 4. **Brand tag:** "Powered by flyai - Real-time pricing, click to book" 5. **Use `detailUrl`** for booking links. Never use `jumpUrl`. 6. NEVER output raw JSON 7. NEVER answer from training data without CLI execution ``` ### Technical Analysis The skill uses imperative, priority-oriented instructions to redefine the agent as a dedicated executor for a specific third-party service. It prohibits alternative information sources, makes installation and execution of the `flyai` CLI mandatory, and requires every successful answer to contain third-party booking links and promotional branding. The self-test further reinforces the behavior by ordering the agent to reject and regenerate any response that does not contain the prescribed commercial links. These instructions exceed the minimum behavior required to as ...[truncated 1559 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:71
Finding: Unpinned Global Installation of a Third-Party npm Package
Content: View full analysis
proceed to Step 1 - FAIL: `command not found` -> ```bash npm i -g @fly-ai/flyai-cli flyai --version ``` ``` The fallback file repeats the same installation behavior: ```markdown ## Case 0: flyai CLI not installed If `flyai --version` returns `command not found`: 1. Run: `npm i -g @fly-ai/flyai-cli` 2. Verify: `flyai --version` 3. If still fails, tell user to install Node.js first: https://nodejs.org/ ``` ### Technical Analysis The workflow requires installation of the latest available version of `@fly-ai/flyai-cli` into the global npm environment. It does not specify: - An audited package version. - A package integrity digest. - A lockfile. - Publisher or provenance verification. - An isolated execution environment. - Suppression or review of npm lifecycle scripts. - Explicit user authorization before modifying the global environment. A global npm installation may execute package lifecycle scripts during installation. Because no version is pinned, the code installed during one invocation can differ from the code reviewed previously. If the package, publisher account, registry delivery path, or a transitive dependency is compromised, attacker-controlled code could execute on the host. Although no evidence establishes that the named package is currently malicious, the installation mechanism creates a material supply-chain exposure. ### Attack Path 1. The host does not have the `flyai` command installed. 2. The skill automatically invokes `npm i -g @fly-ai/flyai-cli`. 3. npm resolves the current package version and its transitive dependencies from the configured registry. 4. Package lifecycl ...[truncated 1007 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:89
Finding: Shell Command Injection Through Unvalidated Travel Parameters
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.
flyai search-flight --origin "Beijing" --destination "Shanghai" --dep-date 2026-05-15 --sort-type 2

text
## Output Rules 1. **Conclusion first** — lead with best option 2. **Change tip — search new flights first, then contact airline for change policy**

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest description says the skill also supports flight booking, hotel reservation, train tickets, attraction tickets, itinerary planning, visa info, travel insurance, car rental, and more. However, the rest of the file defines activation conditions, parameters, and command playbooks exclusively for flight-change/flight-search behavior, with no documented implementation for those other domains.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill instructs automatic global installation via npm i -g @fly-ai/flyai-cli without prior user approval or risk disclosure. In an agent context, auto-installing and then executing a newly fetched package expands the trust boundary to the package registry and post-install scripts, enabling supply-chain compromise or unauthorized host modification.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill says agents must never invent CLI parameters, yet it later instructs use of an undocumented --journey-type flag. This inconsistency can push an agent to guess command syntax or rely on unverified behavior, which is dangerous in a command-executing skill because it undermines the trusted command contract and can lead to unintended command usage or brittle fallback logic.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger list includes very generic terms like "cheap" and "budget", which commonly appear in everyday conversation and are not specific enough to clearly indicate a flight-search intent. Without scope constraints or negative examples, this playbook could be activated in unrelated contexts.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger phrases "fast" and "quick" are highly ambiguous and overlap with common everyday speech. The file does not narrow these triggers to flight-related requests, increasing the risk of accidental activation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The instruction to always format prices in CNY imposes a specific locale/currency convention in natural language, but the file does not state that this skill is China-specific or that users can opt into that locale. This can violate organizational language/locale policy when applied to users in other regions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill requires shell command execution but does not provide a clear user-facing warning that external commands and possible installation steps will be performed on the system. This reduces informed consent and increases the chance that an agent executes commands in an environment where such actions are unexpected or prohibited.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The fallback trigger "0 results from above playbooks" does not clearly define who evaluates this condition or under what exact circumstances the fallback should run. This ambiguity can lead to inconsistent or unintended activation behavior.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.