Security audit

food-tour

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent travel purpose, but it requires risky CLI installation/execution, forces third-party booking links, and can persist raw user queries locally without clear notice.

Install only if you are comfortable with a third-party flyai CLI being installed and used for travel searches and booking links. Review the CLI package separately, avoid running global npm installs with elevated privileges, do not enter sensitive travel or identity details unless logging is disabled or redacted, and require confirmation before any install, command execution, or booking-link action.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:8
Finding: Forced Commercial Output and Agent Behavior Hijacking
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:75
Finding: Shell Command Injection Through User-Controlled Travel Parameters
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/runbook.md:7
Finding: Unsafe Plaintext Logging Enables Sensitive Data Exposure and Secondary Command Injection
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook instructs the agent to store the complete raw user query and command history in `.flyai-execution-log.json`. Travel queries may contain personal itineraries, dates, preferences, or other sensitive information. The design provides no consent mechanism, file-permission requirement, retention limit, or redaction policy. The persistence example also embeds generated JSON inside a single-quoted shell string. A single quote originating from a raw user query can terminate that shell string. The remainder of the input may then be interpre ...[truncated 1500 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:35
Finding: Unpinned Global Installation of Executable Third-Party Dependencies
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.
flyai keyword-search --query "美食成都"

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The README presents the skill primarily as a culinary travel planner, but also states it wraps flyai-cli for real-time travel data and booking links, which materially expands its capabilities. This mismatch can mislead users and reviewers about the operational scope, increasing the chance they authorize broader travel-booking actions or external data access than expected.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The README instructs users to run npx skills add ... without pinning a specific package version, which can cause execution of whatever version is current at install time. In a skill ecosystem that relies on external tooling, this creates a supply-chain risk: a compromised or maliciously updated package could be fetched and executed by users during installation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The 'What It Does' section narrows the skill to food-tour planning even though other documentation indicates broader travel orchestration and booking behavior through flyai-cli. Security-sensitive documentation inconsistencies are dangerous because users may grant trust or permissions based on an incomplete description of what the skill can do.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation phrases include broad everyday queries like "where to eat" and Chinese equivalents such as "吃什么", which are common in general conversation and can cause the skill to trigger outside its intended scope. Because this skill then instructs the agent to install and invoke a CLI, unintended activation can lead to unnecessary command execution and expansion of the attack surface.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The playbook maps an English-language trigger to hard-coded Chinese search terms without any user opt-in, locale detection, or disclosure of the scope. This can systematically return results that do not match the user's language, region, or expectations, creating integrity and usability risks in itinerary generation and potentially misleading travel recommendations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Multiple playbooks use English triggers such as street food, cooking class, and Michelin, but always execute Chinese-language searches. In a travel-planning skill, this increases the chance of irrelevant, biased, or incomplete results across markets, which can degrade booking decisions and route users toward unintended providers or locations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The runbook explicitly records user_query as raw input in an internal execution log, which can capture personal, financial, travel, passport, visa, or other sensitive data commonly provided to a travel-booking skill. Because the document gives no retention, minimization, redaction, or user-notice controls, this creates a real privacy and data-handling risk if logs are stored, accessed broadly, or later reused.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The runbook instructs appending execution logs to a local file, which can persist sensitive operational and user-derived data on disk without encryption, retention limits, or notice. In a travel skill context, those logs may contain itinerary details, booking intents, and potentially visa or identity-related information, making filesystem persistence materially more dangerous.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.