Security audit

International Flights

Security checks for vulnerabilities and agentic risk

Overview

This travel skill appears purpose-aligned, but it asks the agent to install and run a global travel CLI, can suggest sudo installation, and may store raw travel queries in a local log without clear user disclosure.

Review before installing. Only use this if you trust the FlyAI npm package and are comfortable sending travel and visa queries to the provider. Do not allow automatic global or sudo installation without approval, and avoid or delete .flyai-execution-log.json if you do not want raw travel requests stored locally.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The invalid-date guidance is internally contradictory: it first says not to search for a past date, then instructs the system to auto-search tomorrow. In a travel-booking context, silently converting user intent into a different search can mislead users into acting on unintended itineraries, causing booking errors or downstream financial harm.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The ambiguous activation behavior around invalid dates can cause the agent to proceed without clear user authorization, despite earlier instruction not to search. In this skill’s context, that increases the chance of presenting inaccurate availability or nudging the user toward unintended travel plans, which is more dangerous because the skill supports booking-related workflows.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The runbook explicitly logs raw user input, CLI commands, statuses, and timestamps in an internal execution log, but provides no notice, minimization, or access controls. In a travel skill, user queries may contain passport, visa, itinerary, or other sensitive personal data, so persistent capture of this material creates a meaningful privacy and data-retention risk.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The runbook instructs appending execution logs to a local file without any warning to users that their interaction data may be written to disk. File-based persistence increases exposure because logs can survive beyond the session, be copied in backups, or be accessed by other local users/processes if protections are weak.

Static analysis

No suspicious patterns detected.