Security audit

golden-week

Security checks for vulnerabilities and agentic risk

Overview

This travel skill is mostly coherent, but it automatically installs a global third-party CLI and can persist raw travel queries and command logs without clear user notice or retention controls.

Review before installing. Use it only if you are comfortable with a global npm CLI being installed and with travel queries or command details potentially being stored locally; avoid entering passport, payment, or highly sensitive itinerary details unless logging is disabled or redacted.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The runbook explicitly captures the raw user query in an internal execution log, and the same document later provides a persistence mechanism to append that log to disk. For a travel-planning skill, storing unrestricted raw prompts is broader than necessary and can expose sensitive travel details, identities, contact information, or payment-related text if users provide it.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: Mandating logging of every CLI command and fallback recovery command creates an internal record of operational behavior that may include sensitive parameters, tokens, file paths, or user-derived data embedded in commands. In a travel assistant context, this level of command capture is unnecessary for core functionality and increases the blast radius if logs are accessed or persisted.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The runbook instructs appending execution logs to a local file, creating durable storage of potentially sensitive operational and user-derived data. Persistent local logging is not clearly necessary for a peak-season travel assistant and materially increases privacy and forensic exposure if the host is shared, compromised, or improperly managed.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill directs the agent to install `@fly-ai/flyai-cli` globally via `npm i -g` as part of normal execution, which modifies the host environment without explicit user consent or safety gating. In an agent context, automatic package installation expands the attack surface to arbitrary post-install scripts and supply-chain compromise, especially because the package is fetched from an external registry at runtime.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The prerequisites and environment check sections repeatedly instruct the agent to run a global npm install and even retry it automatically if the command is missing. This makes system modification a mandatory part of handling user requests, increasing the likelihood of unreviewed package execution and persistent changes on the machine.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The line 'Knowledge is for parameter mapping — never answer without executing' instructs the agent to avoid providing non-executing or safer advisory responses and pushes it toward tool/command execution by default. This can undermine user consent and safety controls by forcing operational behavior even when the user may only want information, and it reduces the agent's ability to decline execution in risky or ambiguous situations.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The schema stores raw user input and the same runbook supports writing the log to disk, yet there is no user-facing notice or consent mechanism for retention. Because travel queries often contain dates, destinations, names, passport/visa context, and other personal details, silent collection and retention creates a meaningful privacy risk.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The runbook tells the agent to write logs to a local file but does not include any warning, consent, or retention guidance related to local data storage. This is especially problematic in a travel-booking context where logs may contain itinerary and identity-adjacent information that users would not expect to be stored on disk.

Static analysis

No suspicious patterns detected.