Security audit

hongkong-macau

Security checks across malware telemetry and agentic risk

Overview

This travel skill is coherent, but it asks agents to install a global CLI and store raw travel queries locally without enough user control or privacy safeguards.

Review before installing. Only use this skill if you trust the flyai CLI and are comfortable with travel-search details going to FlyAI/Fliggy services. Do not allow the global npm install unless you explicitly approve it, and disable or remove the local execution log if queries may contain personal, booking, visa, or contact information.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The README states that the skill provides real-time travel data and booking links, which implies external network access and possible transmission of user travel queries or booking-related data to third-party services. Omitting an explicit warning about outbound requests, third-party data handling, and booking-link redirection can mislead users and agents about privacy and trust boundaries, especially in autonomous or semi-autonomous environments.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill explicitly instructs the agent to install and run a global npm package and treats that execution path as mandatory. This causes unreviewed system modification and external code execution without user consent, which is dangerous in an agent context because the package may change over time, introduce supply-chain risk, or execute with the user's privileges.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill is designed to send user travel searches to the flyai CLI for booking and real-time pricing, but it never warns that user inputs may be transmitted to an external service. Travel plans can contain sensitive personal or commercial information, so silent forwarding creates a privacy and data-handling risk.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The fallback instructs the agent to use unspecified 'domain knowledge' when visa information is unavailable, without defining strict trigger conditions, scope limits, or freshness requirements. In a travel-booking skill, this can lead to the model presenting outdated or hallucinated visa rules as actionable travel guidance, causing users to make plans based on incorrect entry requirements.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The runbook explicitly records `user_query` as raw input in an internal execution log without any stated minimization, masking, retention limit, or user notice. In a travel-booking skill, users may provide names, passport/visa details, contact information, booking references, or payment-adjacent data, so retaining raw prompts increases privacy and data-exposure risk if logs are accessed, leaked, or reused.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The persistence step appends the full execution log to a local file, which can include raw queries, CLI commands, and operational metadata, but provides no safeguards around encryption, permissions, rotation, or retention. Persistent local logs create a durable copy of potentially sensitive travel and booking data that may be exposed to other processes, operators, or later compromise.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The runbook directs the agent to retain raw user input in an internal log, which is a direct data-retention risk because prompts may contain sensitive personal and travel-related information. Given this skill supports flights, hotels, visas, insurance, and rentals, the context makes the issue more dangerous because users are more likely to submit PII and itinerary details that should not be broadly retained.

Ssd 3

Medium

Confidence: 98% confidence
Finding: Persisting the full execution log to `.flyai-execution-log.json` turns transient sensitive data into a long-lived artifact, increasing the chance of unauthorized disclosure, accidental inclusion in backups, or later exfiltration. In this travel skill, those logs may contain booking behavior, personal identifiers, and command traces, making the persistent storage materially riskier than temporary in-memory telemetry.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.