Security audit

group-tour

Security checks for vulnerabilities and agentic risk

Overview

This travel skill is not clearly malicious, but it needs Review because it can automatically install an unpinned global CLI and persist raw travel queries in a local log.

Install only if you trust the flyai CLI publisher and are comfortable with a global npm install, outbound travel searches, third-party booking links, and local retention of query details. Prefer pinning versions, requiring explicit approval before installation, validating booking-link domains, and disabling or redacting execution logs before use.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:10
Finding: Mandatory Commercial Output and Agent Behavior Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:125
Finding: Unpinned Third-Party Package Installation and Execution
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/runbook.md:5
Finding: Shell Injection and Sensitive Data Exposure in Execution Logging
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook stores `{raw input}` and generated command strings in JSON and then demonstrates persistence by placing the complete generated JSON inside a single-quoted shell argument. No escaping or structured serialization mechanism is defined. If `generation_log_json` contains an apostrophe originating from a user query or command, it can terminate the shell's single-quoted argument. Subsequent characters may then be interpreted as shell syntax. JSON escaping does not make arbitrary data safe for shell interpolation because JSON ...[truncated 2019 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 198)May include surrounding context.
flyai keyword-search --query "跟团游日本"

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: The README instructs users to run npx skills add alibaba-flyai/flyai-skill/tree/main/skills/group-tour, which references a moving branch path rather than a pinned commit, tag, or immutable release. This creates a supply-chain risk: future changes to the upstream repository or branch could cause users to install different code than originally reviewed, including malicious updates.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill instructs the agent to install a global npm package automatically as part of normal execution, without explicit user consent or a warning that this modifies the host system. Auto-installing and executing third-party CLI tools expands the trust boundary, can introduce supply-chain risk, and may alter the user's environment unexpectedly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The prerequisites section normalizes a global install as a standard step but does not disclose that it changes the system state or that the package will later be trusted for travel data retrieval. In an agent setting, this can cause silent system modification and execution of unreviewed code from an external registry.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The workflow explicitly tells the agent to retry a global installation automatically if the command is missing, then proceed with execution. This is dangerous because a missing dependency becomes a trigger for unattended package installation and subsequent execution, creating avoidable supply-chain and environment-tampering risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The markdown defines commands that always search using Chinese phrases such as "跟团游", "高端跟团游", and "老年人跟团游". This imposes a specific language/locale behavior without any documented user opt-in or explanation that the skill is region-specific.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The runbook explicitly records the user's raw input in an internal execution log, which can capture sensitive travel data, personal identifiers, payment-related details, passport/visa information, or other private content. Because the log is described as internal and not shown to users, this creates undisclosed data retention and downstream exposure risk if logs are accessed, copied, or reused.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Storing raw natural-language user input creates a direct data retention risk because free-form travel queries often contain unexpectedly sensitive details such as names, contact data, dates of travel, locations, visa needs, or special accommodations. In a travel-booking skill context, this risk is heightened because users commonly provide personal and itinerary information that can be valuable if leaked.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The runbook instructs appending execution logs to a local file, creating persistent storage of operational data without any safeguards or disclosure. Persistent disk logging increases the chance that sensitive travel requests, command history, or generated links remain recoverable beyond the session and are exposed through filesystem access, backups, or log collection.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: An append-only execution log preserves historical user-provided content and operational traces over time, increasing both blast radius and dwell time for any accidental disclosure or compromise. In this skill's travel context, accumulated logs may reveal patterns of movement, booking intent, and other sensitive trip data across many sessions, making the persistence more dangerous than ephemeral telemetry.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The template output and failure guidance consistently reference 'flyai' branding and CLI commands, which conflicts with the skill metadata claiming a Fliggy-powered group-tour skill. This can mislead users into trusting or invoking the wrong toolchain, and in the failure case may direct them to run unrelated local commands, creating a supply-chain/phishing-style risk if users install or use an unintended package.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This is a markdown file, so SQP-2 applies to omissions in the skill description. The overview states that the skill wraps a CLI to provide real-time travel data with booking links, which implies outbound network activity and interaction with third-party services, but the README does not disclose any privacy or external-service implications.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.