ClawHub
Back to skill

Security audit

last-seat-flight

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed flight-search skill that runs a travel CLI, with some documentation and install-consent issues users should review before use.

Install only if you are comfortable letting the agent run flyai travel-search commands and, if needed, install the FlyAI CLI globally. Review the exact npm install command and each generated flight-search command before approving, and inspect booking links before making any purchase.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The skill explicitly says agents must never invent CLI parameters and only use flags listed in the Parameters table, but the Direct Route playbook uses `--journey-type 1`, which is undocumented. This inconsistency can cause agents to execute unvetted or unsupported options, undermining guardrails and increasing the chance of unexpected behavior or misuse of the CLI.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The activation trigger includes broad phrases like 'book a flight' / '订机票', which are not specific to last-seat scenarios. That can cause the skill to activate for ordinary travel requests and push the agent into mandatory CLI execution and formatting rules outside the user's actual intent, increasing the risk of overreach and unintended external actions.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill frames the agent as a CLI executor and instructs it to install software if the CLI is missing, but does not require explicit user consent before modifying the environment. Silent package installation is a security risk because it changes system state, introduces third-party code, and may violate least-privilege or user expectations.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The fallback path instructs the agent to run `npm i -g @fly-ai/flyai-cli` automatically when `flyai` is missing, again without disclosure or consent. Globally installing an npm package executes a supply-chain trust decision and modifies the host environment, which is particularly dangerous in an agent context where users may not expect persistent system changes.

Static analysis

No suspicious patterns detected.