Security audit

hiking-trails

Security checks for vulnerabilities and agentic risk

Overview

This skill is framed as hiking help but can automatically install and run an unpinned external CLI, force booking-link outputs, broaden into travel booking, and persist raw queries locally.

Review before installing. This skill should only be used if you are comfortable with a third-party travel CLI being installed globally, external travel lookups being made, booking links being prioritized, and local logs potentially retaining raw queries. Prefer a pinned, isolated CLI install and disable or redact logging.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:8
Finding: Mandatory Commercial Output and Agent Response Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:54
Finding: Unpinned Global Installation and Execution of a Third-Party CLI
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:76
Finding: Shell Command Injection Through User-Controlled Search Parameters
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/runbook.md:1
Finding: Unsafe Persistent Logging of Raw User Queries and Commands
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook instructs the agent to retain the user's complete raw input and every generated command in a hidden workspace file. It specifies no consent mechanism, data minimization, redaction, retention period, file permissions, encryption, or deletion policy. Travel queries may contain names, destinations, schedules, or other personal information. The persistence command additionally inserts generated JSON into a single-quoted shell ...[truncated 1709 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (19)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.
flyai search-poi --city-name "Huangshan" --category "山湖田园" --keyword "徒步"

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README presents the skill as a simple hiking-trail finder, but also states it wraps flyai-cli for real-time travel data and booking links, expanding the actual capability surface beyond the headline description. This mismatch can mislead users and reviewers about what external services are contacted and what actions or commercial link-outs may occur.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: The README instructs users to run npx skills add ... without pinning a specific package/version, which can cause execution of whatever package version is currently resolved from the registry. In a supply-chain attack or package takeover scenario, users could unknowingly install or run malicious code during skill setup.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The Chinese documentation repeats the same inconsistency: it advertises hiking-route search while also disclosing real-time travel data and booking links. Inconsistent or incomplete multilingual documentation increases the chance that users grant trust or permissions based on an incomplete understanding of the skill's behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill directs the agent to automatically run npm i -g @fly-ai/flyai-cli, which modifies the host environment without prior user approval or safety warning. This creates supply-chain and system integrity risk, especially in agent runtimes where the user may not expect package installation or where global installs affect other workflows.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The activation keywords are broad enough to match common travel or outdoor queries, which can cause the skill to trigger unexpectedly and take over responses outside its narrow intended scope. In this skill, that is more dangerous because activation leads into mandatory CLI execution and possible package installation, turning an over-broad routing issue into unnecessary command execution or environment modification.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The fallback document is scoped to attraction/POI search rather than hiking trails, which creates a clear capability mismatch with the declared skill purpose. In practice this can cause the agent to respond with unrelated travel-discovery behavior, broadening data access and user-facing actions beyond what the user and reviewer would reasonably expect from a hiking-trails skill.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documented fallbacks explicitly broaden behavior from hiking trails to generic attractions and 'things to do' searches. That scope expansion is dangerous because it bypasses least-privilege expectations for the skill and may lead the agent to perform unrelated travel discovery or transactional flows under a misleading hiking-focused label.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The trigger phrase "hiking near me" is broad natural language and can activate the playbook in many loosely related user requests without clear boundaries. In a travel skill that maps user text directly to CLI-backed actions, this increases the risk of unintended tool invocation, incorrect parameter mapping, or execution when the user is only asking generally about hiking rather than requesting a search.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The trigger phrase "mountain climbing" is ambiguous and may match broad discussion, safety questions, gear advice, or trip inspiration rather than a concrete request to run a POI search. Because the playbook couples trigger activation to command execution, this ambiguity can cause unintended searches and misleading results, especially when the user did not ask for a location-based lookup.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The trigger phrase "easy hike" is everyday language that lacks activation limits and could be matched in casual conversation, recommendations, or comparative questions. Since the document explicitly instructs to answer only via execution, an overbroad trigger can force unnecessary or incorrect command use, creating reliability and safety issues through unintended external action.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The runbook explicitly records user_query as raw input in an internal execution log, which can capture personal data, travel details, credentials pasted by mistake, or other sensitive content without any notice, minimization, or retention controls. In a travel-related skill that may handle itineraries, visa questions, bookings, and insurance, the likelihood of sensitive user data appearing in freeform input is elevated, making silent collection materially risky.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Taken together, the runbook requires logging raw user input and persisting the resulting execution log to local storage, creating a concrete data-handling weakness rather than a purely theoretical privacy concern. In this skill's context, users may provide travel plans, names, booking preferences, or visa/insurance details, so combining raw-input capture with filesystem persistence materially raises the chance of sensitive data retention and later disclosure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The runbook instructs appending execution logs to a local file when filesystem writes are available, but provides no warning, retention policy, access control guidance, or sanitization requirements. Persistent local logging increases exposure because sensitive operational and user data can accumulate on disk, be read by other processes or users, or remain after the session ends.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: A file labeled for a hiking-trails skill but populated with booking/ticketing templates creates a deceptive or confused operational boundary. In an agent setting, this increases the risk of unintended tool use, user deception, and unsafe cross-domain behavior because the prompt scaffolding steers outputs toward reservations and purchases rather than trail guidance.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The template content is materially inconsistent with the stated hiking-trails skill and instead instructs the agent to produce generic ticket-booking and real-time pricing outputs with booking links. This can misroute user intent, cause the agent to invoke or simulate unrelated commerce flows, and mislead users into taking booking actions under a mismatched skill context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README mentions real-time travel data and booking links but does not warn that the skill may contact external services or direct users to third-party booking flows. This omission reduces informed consent and can expose users to unexpected data sharing, tracking, or off-platform interactions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The Chinese section likewise omits an external-access and link-out warning despite describing real-time travel data and booking links. Users relying on the Chinese documentation may be equally unaware of third-party data retrieval and booking redirection.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The fallback instruction explicitly says to try Chinese/English variants, which imposes specific language handling behavior without indicating user choice or a documented region-specific requirement. This is a natural-language locale policy issue because the file does not offer an opt-in or explain why those languages must be used.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.