Security audit

honeymoon-trip

Security checks for vulnerabilities and agentic risk

Overview

This travel-planning skill is coherent with its FlyAI booking purpose, but it asks for broad automatic tool execution, unpinned global npm installation, and hidden persistent logging of raw user travel queries.

Install only if you trust FlyAI/Fliggy and want booking-link-centered results. Before use, require explicit approval for npm installation, prefer a pinned/local CLI install, disable or redact the execution log, and ensure the agent invokes the CLI with safe argument arrays rather than shell-interpolated user text.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:8
Finding: Mandatory Commercial Output and Agent Instruction Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:122
Finding: Unpinned Global Installation of a Third-Party npm Package
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/fallbacks.md:10
Finding: Shell Command Injection Risk in User-Controlled CLI Parameters
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/runbook.md:1
Finding: Hidden Plaintext Logging of Raw User Queries and Unsafe Shell Serialization
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook instructs the Agent to retain the complete raw user query, collected parameters, commands, timestamps, and recovery actions in `.flyai-execution-log.json`. It explicitly describes the log as internal and not shown to users. Honeymoon and travel requests may contain personal names, precise travel dates, origin and destination locations, budgets, and other itinerary details. No consent require ...[truncated 2202 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 198)May include surrounding context.
Full romantic orchestration to Maldives or Bali

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The README instructs users to run npx skills add alibaba-flyai/flyai-skill/tree/main/skills/honeymoon-trip, which pulls and executes tooling without pinning to a specific immutable version or commit. Because it references a moving target (main) and relies on npx, a future compromise of the package or upstream repository could cause users to install or run altered code.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger phrase "honeymoon trip" is broad enough to activate on ordinary travel-planning requests without an explicit confirmation boundary. Because the playbook says to "never answer without executing," an ambiguous activation could steer the agent into tool-driven booking or itinerary flows when the user only intended to ask for general advice.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The trigger "beach honeymoon" is ambiguous and likely to overlap with normal conversational travel requests, making accidental activation plausible. In a travel skill with booking and reservation capabilities, this can cause the agent to enter an operational flow prematurely and produce or initiate actions beyond the user's intended scope.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The phrase "affordable honeymoon" is a generic natural-language request rather than a safely bounded control phrase, so it may collide with benign travel discussions. Given the skill's support for flights, hotels, tickets, and other travel services, overly generic activation increases the risk of unintended tool use, inappropriate recommendations, or progression into transactional workflows without clear consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The runbook explicitly stores user_query as raw input in an internal execution log, while also stating the log is not shown to users. That creates a privacy risk because travel queries often contain sensitive personal, financial, itinerary, or passport/visa-related details, and the user is given no notice, minimization, or retention controls.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The schema directs retention of raw user input in an internal log, which is a direct data-minimization failure. In this skill context, honeymoon and travel planning requests can include dates, destinations, relationship details, booking preferences, and potentially passport, visa, or insurance information, making raw retention especially sensitive.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The runbook instructs persistent file-based logging of execution data by appending JSON records to .flyai-execution-log.json, but provides no safety guidance on permissions, retention, encryption, or user notice. Persisting operational and user-derived data in a local file increases the chance of unintended disclosure, accumulation of sensitive history, and unauthorized access on shared or compromised systems.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Appending internal execution logs to a local file enables long-term accumulation of user-provided and operational data, expanding blast radius if the host is accessed by other users, malware, backups, or support tooling. Because the file is append-only in the example, sensitive history can grow indefinitely without safeguards or lifecycle management.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.