Security audit

golden-week

Security checks for vulnerabilities and agentic risk

Overview

This travel skill is not clearly malicious, but it needs Review because it can auto-install a global CLI and store raw travel queries locally without clear consent or retention controls.

Install only if you are comfortable with a travel skill that depends on a third-party FlyAI CLI, sends trip searches to external services, shows booking links, and may write local logs containing raw prompts. Prefer a pinned CLI version, require explicit approval before npm install, and disable or redact .flyai-execution-log.json logging before use.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:8
Finding: Mandatory Commercial Output and Booking-Link Injection
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:51
Finding: Unpinned Global Installation of Mutable Third-Party Dependencies
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/runbook.md:7
Finding: Unsafe Persistence of Raw User Queries Through Shell-Constructed Logs
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook instructs the agent to retain the complete raw user query in a hidden local log file. Travel prompts may contain names, dates, routes, accommodation details, contact information, or other sensitive personal data. The logging design provides no consent requirement, field-level redaction, retention period, encryption, access-control requirement, or deletion process. The example writes generated JSON by interpolating it into a single-quoted shell command. If an implementation substitutes raw or insufficiently escaped user-controlled ...[truncated 2043 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.
flyai search-flight --origin "Shanghai" --destination "Sanya" --dep-date 2026-10-01 --sort-type 3

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The README instructs users to run npx skills add ... without pinning a specific package version, which can cause execution of whatever version is current at install time. In a supply-chain compromise or malicious package update scenario, users could fetch and execute unexpected code during installation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly instructs the agent to install a global npm package (npm i -g @fly-ai/flyai-cli) automatically if the command is missing, without requiring user consent or warning about system modification. This is dangerous because it authorizes code execution and persistent environment changes from an untrusted package source, expanding the attack surface and enabling supply-chain compromise or unwanted host changes.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrase "avoid crowds during holiday" is broad enough to overlap with ordinary user travel requests, which can cause this playbook to activate in situations the user did not clearly intend. In an agentic booking/travel skill, overly generic triggers increase the chance of misrouting requests and executing the wrong workflow, especially when the file states answers should not be given without execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The runbook explicitly logs user_query as raw input and persists the full execution log to a local file, while also stating this log is internal and not shown to users. In a travel-booking context, user queries can contain names, destinations, dates, passport or visa details, contact data, and other sensitive travel information, creating an avoidable privacy and retention risk if the host is multi-tenant, compromised, or logs are later exposed.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file instructs the agent to append execution logs containing raw user_query to .flyai-execution-log.json, which creates durable local storage of potentially sensitive user-supplied data. Because the skill handles peak-season travel planning and bookings, queries may include itinerary details, identity information, or booking-related secrets, so persistent local logging materially increases exposure in the event of unauthorized access or accidental disclosure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This markdown file states that the skill wraps a CLI to provide real-time travel data with booking links, which implies outbound network requests and sharing of user-supplied trip details with external services. The description does not include any warning about contacting third-party services, privacy implications, or data handling.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 60% confidence
Finding: The file includes a full Chinese-language section labeled as documentation, but it does not explicitly state that language is selectable or user-preference driven. Because language/locale policy violations concern forcing a specific language without opt-in, this is a mild concern where the documentation could more clearly indicate bilingual support rather than a fixed locale.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.