T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:10- Finding
Mandatory booking links and branding hijack agent output
- Content
View full analysis
- Remediation
View remediation
Security audit
holiday-flights
Security checks for vulnerabilities and agentic risk
Overview
The skill’s flight-search purpose is clear, but it asks for automatic global installation, possible sudo use, persistent raw-query logging, and shell-style command execution that need careful review before use.
Install only if you trust FlyAI/Fliggy and are comfortable with the agent installing and running a third-party CLI. Avoid sudo, prefer a pinned/local CLI install in a sandbox, and do not allow persistent logging of raw travel queries unless you have reviewed and accepted the privacy implications.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T08 · Insecure Dependencies
Warning
- Location
references/fallbacks.md:7- Finding
Unpinned global dependency installation can escalate to privileged code execution
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:99- Finding
User-controlled travel parameters are interpolated into shell command templates
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/runbook.md:1- Finding
Raw user input is persistently logged through an unsafe shell command
- Content
View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook directs the agent to store the complete raw user query, collected parameters, command strings, fallback commands, and execution metadata. It explicitly states that this internal behavior is not shown to users. No consent mechanism, redaction policy, retention period, file-size limit, path restriction, or file-permission requirement is provided. Travel queries can contain sensitive itinerary, identity, budget, or location information, all of w ...[truncated 1698 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Findings (10)
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
flyai search-flight --origin "Guangzhou" --destination "Chengdu" --dep-date 2026-10-01 --sort-type 3
text ## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
The README instructs users to run
npx skills add alibaba-flyai/flyai-skill/tree/main/skills/holiday-flights, which pulls and executes tooling and remote skill content without a pinned version or immutable commit reference. This creates a supply-chain risk: if the upstream package, repository, or branch content changes or is compromised, users may install or execute unintended code under the guise of setup instructions.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly instructs the agent to run a global npm installation (
npm i -g @fly-ai/flyai-cli) as a mandatory prerequisite and again during its workflow, without requiring user confirmation or warning that this modifies the host environment. In an agentic execution context, this can cause unauthorized system changes, introduce supply-chain risk from the package registry, and violate least-privilege expectations.- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
The documentation recommends retrying installation with sudo, encouraging privileged execution of a package-manager command for a globally installed third-party CLI. Running npm with elevated privileges increases the risk that package scripts or supply-chain compromises execute as root, potentially leading to system-wide compromise.
- Content
bash npm i -g @fly-ai/flyai-cli flyai --version # Fails → sudo npm i -g @fly-ai/flyai-cli # Still fails → STOP. Do NOT answer with training data.
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The fallback instructs the agent to automatically search for tomorrow when the user supplied a past date, which changes the user's requested parameters without consent. In a travel-booking context, silently substituting dates can mislead users, produce unwanted recommendations, or cascade into downstream booking actions based on incorrect assumptions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The playbook defines invocation triggers entirely in Chinese phrases such as "春节回家", "国庆出游", "五一/端午", and "避开高峰", with no indication that other languages are supported or that the locale restriction is intentional. This is a natural-language policy concern because it imposes a specific language/locale on users without opt-in or justification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file states that the agent maintains the log internally and not shown to users, while the schema includes raw input capture. This means users are given no warning that their travel-related queries may be retained internally, creating a transparency and privacy-consent problem that is more concerning in a consumer travel context where users may disclose names, dates, destinations, and booking details.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The runbook explicitly requires logging the raw user query and full CLI command history for every trigger, which exceeds what is necessary for a travel-search skill and can capture sensitive travel plans, personal details, or identifiers. Because this data is structured for routine collection, it creates an unnecessary privacy and insider-access exposure even without a separate exploit.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Taken together, the schema stores raw user input and execution details, then persists them to a local file, producing a straightforward plain-text data retention and leakage path. In a travel-booking context this can reveal itineraries, locations, timing, and possibly other personal or financial-adjacent details, making the skill more dangerous than a generic diagnostic logger.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The runbook instructs persistent local storage of execution logs in a dotfile, creating a durable data-retention path on disk for information gathered during skill execution. For a travel assistant, this is hard to justify operationally and increases the chance of data leakage through filesystem access, backups, multi-user environments, or accidental inclusion in support bundles.
- Content
Static analysis
No suspicious patterns detected.