Security audit

hongkong-macau

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent flyai travel-booking wrapper, but it needs review because it mandates unpinned global CLI installation and hidden raw-query logging.

Install only if you intentionally want a flyai/Fliggy-centered booking workflow. Use an isolated, pinned CLI install, require approval before package installation or booking actions, and avoid entering passport, payment, contact, or other sensitive travel data until the raw-query logging behavior is removed or clearly controlled.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:9
Finding: Mandatory Commercial CLI and Output Instruction Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:114
Finding: Unpinned Global and Remote Dependency Installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/runbook.md:6
Finding: Unsafe Persistence of Raw User Queries Through Shell-Constructed Logs
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook directs the agent to store raw user input and complete CLI command details in a hidden local file. No consent mechanism, data minimization policy, redaction, retention period, file permission requirement, or secure deletion procedure is defined. The suggested persistence mechanism interpolates generated JSON into a single-quoted shell command. If raw input or another logged value contains a single quote or shell syntax, it can terminate the quoted string and alter the command interpreted by the shell. Merely JSON-encoding a value is not sufficient shell escaping. Appending independent JSON objects with `>>` can also produce a file that is not valid as a single JSON document, complicating safe parsing and potentially causing downstream tools to process mal ...[truncated 1619 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 198)May include surrounding context.
flyai search-flight --origin "Shanghai" --destination "Hong Kong" --dep-date 2026-05-01 --sort-type 3

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The README instructs users to run npx skills add ... without pinning a specific package version or immutable source. This can expose users to supply-chain risk if the resolved package or tool version changes unexpectedly or is compromised, especially because npx may fetch and execute code on demand.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation triggers include very broad abbreviations like "HK" that can appear in unrelated contexts, causing the skill to activate when the user did not intend to invoke travel-booking behavior. In an agent environment, accidental activation can route arbitrary user input into the skill’s command-oriented workflow, increasing the chance of inappropriate command execution or unwanted package-install attempts.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger phrase "Hong Kong Macau trip" is broad and can be matched during ordinary conversation, making unintended activation of this playbook plausible. Because the playbook is tied to transactional travel actions and the file states answers should not be given without execution, misfires could cause the agent to invoke booking-oriented flows when the user is only discussing ideas or comparing destinations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The trigger "Hong Kong trip" is ambiguous and likely to appear in normal travel discussion, so it may activate the Hong Kong-only playbook without sufficiently specific user intent. In this skill's context, that matters because the playbook maps toward flights, hotels, and POIs, increasing the chance of unintended workflow execution or misleadingly narrow results.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The phrase "Macau trip" is similarly vague and may overlap with casual mentions, creating a risk that the Macau-specific playbook is selected prematurely. Since this skill supports bookings and itinerary actions, an overly loose trigger can steer the agent into the wrong transactional path or omit needed clarification such as whether the user wants flights, ferry options, hotels, or just informational guidance.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The runbook defines an internal execution log that captures the raw user query (user_query) and states it is maintained internally without any disclosure, minimization, or retention controls. In a travel-booking skill, user inputs may contain names, dates, destinations, passport/visa details, contact information, or other sensitive travel data, so silently retaining raw input creates a meaningful privacy and data-handling risk.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The schema explicitly includes user_query: {raw input} in the execution log, which directs retention of complete unfiltered user content. Because this skill supports bookings, visas, insurance, and related travel workflows, raw input may contain especially sensitive personal and itinerary data, making full-query logging more dangerous in this context than in a low-sensitivity informational skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The runbook explicitly instructs appending the execution log to a local file, creating persistent storage of operational data without warning, consent, or safeguards. Persistent local logs increase exposure because sensitive data can remain on disk, be copied in backups, or be accessed by other processes or operators long after the request completes.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The persistence instruction stores the full generated execution log, which includes prior fields such as raw user input and command history, to .flyai-execution-log.json. This broad retention compounds risk by preserving potentially sensitive user data and operational traces in a durable artifact that may be inadvertently exposed, exfiltrated, or reused beyond its original purpose.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.