Security audit

hiking-trails

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real FlyAI travel-search skill, but it needs review because it can automatically install a global CLI and persist raw user travel queries locally.

Install only if you want FlyAI/Fliggy-backed live travel results with booking links. Prefer installing and reviewing the flyai CLI yourself before use, avoid entering sensitive itinerary or identity details, and delete or disable .flyai-execution-log.json if you do not want local query history retained.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The README presents the skill as a narrow hiking-trail finder, but also discloses that it wraps a broader travel CLI that provides real-time travel data and booking links. This capability mismatch can mislead users and agents about the skill's actual scope, causing them to invoke a tool with broader travel/booking behavior than expected and weakening informed consent and least-privilege assumptions.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The Chinese documentation repeats the same scope inconsistency by advertising hiking-route search while stating that the skill uses flyai-cli for real-time travel data and booking links. In multilingual ecosystems, inconsistent or understated capability disclosure is especially risky because some users may rely only on one language section and miss the broader operational scope.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The activation triggers are broad enough to match common travel or outdoor queries such as walking, climbing, or trekking, which can cause the skill to activate outside its intended scope. In this skill, unintended activation is more concerning because the workflow mandates CLI execution and even package installation, so a casual conversation could trigger unnecessary command execution or attempts to install software.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger phrase "hiking near me" is broad natural language that could match many ordinary user requests without clear activation boundaries. Because the playbook says to never answer without executing, an unintended match could cause the agent to invoke a CLI-backed search when the user did not explicitly intend tool execution, increasing the risk of over-broad or unnecessary external actions.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The trigger phrase "mountain climbing" is underspecified and could activate on general discussion, safety questions, or trip planning conversations that are not requests to run the search command. In this skill, unintended invocation is more concerning because the document explicitly binds answers to command execution, so ambiguous routing can directly lead to unnecessary external tool use.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger phrase "easy hike" is vague and could be matched from casual recommendations, packing advice, or fitness-level discussions rather than a concrete search request. Given the skill's travel-assistant context and the instruction to rely on CLI execution, this ambiguity can cause unintended tool invocation and incorrect parameter mapping from incomplete user input.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The runbook explicitly stores `user_query` as raw input in an internal execution log, which can capture sensitive personal, travel, identity, payment-adjacent, or health-related information users may submit. Because the documentation says the log is internal and not shown to users, this creates a privacy and data-retention risk without transparency, consent, minimization, or handling safeguards.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The runbook instructs appending execution logs to a local file, creating durable storage of operational and user-derived data with no stated retention period, access restrictions, encryption, or deletion policy. Persistent logging increases the blast radius of any host compromise, misconfiguration, or accidental disclosure because historical interactions remain available long after a request completes.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The schema combines raw `user_query` capture with persistent append-only local storage, which can accumulate sensitive travel queries, personal identifiers, booking details, and other confidential context over time. In this skill's travel/booking context, users may provide passport, visa, itinerary, insurance, hotel, or transportation details, making the privacy exposure more serious than generic debugging logs.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.