Security audit

International Flights

Security checks for vulnerabilities and agentic risk

Overview

The skill is travel-related, but it asks agents to install and run an unpinned global CLI, includes a sudo fallback, builds shell commands from user travel input, and stores raw query logs without user notice.

Install only if you trust the flyai CLI source and are comfortable with it handling your travel queries. Do not run the sudo fallback, avoid unpinned global installs, require confirmation before any install or CLI execution, and avoid entering passport, payment, or other sensitive details unless logging is disabled or clearly controlled.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:10
Finding: Forced Agent Behavior and Promotional Output Injection
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:34
Finding: Automatic Installation of an Unpinned Third-Party Package
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: references/fallbacks.md:3
Finding: Root-Level Installation of an Unpinned npm Package
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:91
Finding: Shell Command Injection Through User-Derived Travel Parameters
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/runbook.md:3
Finding: Unsafe Persistent Logging of Raw User Queries and Commands
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The logging design captures the raw user query, collected parameters, complete commands, and recovery commands. It then recommends persisting the generated JSON to a hidden file without defining user consent, retention, redaction, access permissions, or secure deletion. Travel queries may contain personal information, travel schedules, passport or visa details, budget data, and other sensitive context. Persisting complete command strings duplicates these values. The shell-writing pattern is also unsafe. The generated JSON is embedded inside a si ...[truncated 1626 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.
flyai keyword-search --query "Japan visa"

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The README instructs users to run npx skills add ... without pinning a specific package version, which can cause execution of whatever package version is current at install time. If the referenced package or one of its dependencies is compromised, users may unknowingly execute malicious code during installation or skill setup.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The activation rules are broad enough to trigger on ordinary travel-related conversation, which can cause the agent to invoke this skill unexpectedly. In this skill, unintended activation is more risky because the workflow then instructs command execution and possible package installation, expanding impact beyond a simple misroute.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill directs the agent to run a global npm installation without explicit user consent or a warning that it will modify the system environment. This is dangerous because installing and executing a package from a registry introduces supply-chain and environment-modification risk, especially when auto-triggered by a broad activation rule.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 97% confidence
Finding: The fallback explicitly instructs use of sudo npm i -g, which runs an npm lifecycle script as root and can grant full system compromise if the package or its dependencies are malicious or tampered with. In an agent skill context, operational runbooks may be followed automatically or by a user without scrutiny, so embedding privilege-escalation guidance increases the chance of unsafe execution.
Content: Scanner excerpt · references/fallbacks.md (reported line 10)May include surrounding context.
bash
npm i -g @fly-ai/flyai-cli flyai --version # Fails → sudo npm i -g @fly-ai/flyai-cli # Still fails → STOP. Do NOT answer with training data.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The runbook explicitly logs user_query as raw input in an internal execution record, but provides no disclosure, minimization, or retention controls. In a travel-booking skill, user queries may contain passport, visa, itinerary, contact, or payment-adjacent details, so storing them silently increases privacy and compliance risk if logs are accessed, reused, or retained longer than necessary.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This runbook combines raw user input capture with a persistence mechanism, meaning sensitive requests can be retained in an internal durable log. Given the skill handles international travel, visa, booking, and itinerary workflows, queries may include high-value personal and travel information that could enable privacy violations, profiling, or downstream misuse if the log is exposed.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The runbook instructs the agent to append execution logs to a local file, creating persistent storage of potentially sensitive interaction data without any notice to the user. Persisting logs to disk broadens exposure because data may remain after the session, be copied in backups, or be readable by other local processes or operators.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The trigger line mixes an English phrase with a Chinese-only trigger literal ("去日本") but provides no explanation that the skill is intentionally multilingual or limited to specific locales. This can violate language/locale policy expectations because it hard-codes a language-specific activation path without documenting user opt-in or scope.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest says the skill is powered by Fliggy (Alibaba Group), but the standard result template claims 'Powered by flyai'. This is an active documentation-level contradiction about the service behind the skill, not just an omitted detail.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file documents troubleshooting and retry steps using 'flyai' and 'flyai-cli', while the manifest describes a Fliggy-powered travel skill. This creates intent/documentation divergence by instructing operators or users to use a different underlying tool than the one the skill claims to rely on.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.