Security audit

honeymoon-trip

Security checks across malware telemetry and agentic risk

Overview

This travel-planning skill matches its purpose, but it needs review because it can install a global travel CLI and keep raw trip requests in a local log without clear user control.

Install only if you trust the FlyAI npm CLI and are comfortable with third-party travel lookups. Approve any CLI installation yourself, avoid entering unnecessary personal or payment-adjacent details, and delete or disable `.flyai-execution-log.json` if you do not want raw trip requests stored locally.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Missing User Warnings

Low

Confidence: 89% confidence
Finding: The README states that the skill provides real-time travel data and booking links, which implies outbound network access and possible transmission of user travel details to external services, but it does not disclose this behavior or any privacy implications. In a travel-booking context, users may share sensitive itinerary, identity, or payment-adjacent information, so lack of notice can mislead users about where their data is going.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to run a global npm install of `@fly-ai/flyai-cli`, which modifies the host environment and executes code from an external package source without any user confirmation or warning. In an agent setting, this creates supply-chain and system-integrity risk because merely invoking the skill can cause persistent changes on the machine.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The prerequisites section tells the agent to install a global package as part of normal operation, again without disclosing that this changes the system state. Because the skill frames installation as a prerequisite rather than an optional manual setup step, it increases the chance that an autonomous agent will execute it automatically.

Missing User Warnings

Medium

Confidence: 99% confidence
Finding: The environment-check workflow mandates automatic fallback to `npm i -g @fly-ai/flyai-cli` when the command is missing, making system modification part of the execution path rather than a separate setup task. This is more dangerous than a passive prerequisite because it directly pressures the agent to execute a network-fetched installer at runtime, amplifying supply-chain and persistence risks.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The runbook explicitly persists an execution log containing `user_query` and other request metadata to a local file, while also stating the log is internal and not shown to users. This creates silent retention of potentially sensitive travel data, personal identifiers, and booking-related details without notice, consent, minimization, or retention controls.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The schema requires storing `user_query: {raw input}` in an internal persistent execution log and retaining CLI/fallback details that may further expose user-provided content. In a honeymoon travel skill, raw inputs can include highly sensitive personal and itinerary information, increasing privacy, compliance, and secondary exposure risks if the log file is accessed, copied, or mishandled.

VirusTotal

57/57 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.