Security audit

Luxury Escape

Security checks for vulnerabilities and agentic risk

Overview

This luxury travel skill should go to Review because it automatically installs a global third-party CLI, forces provider booking links, and persists raw travel queries without clear user control.

Install only if you trust the flyai CLI and are comfortable with a global npm dependency, provider-controlled booking links, and local logging of travel requests. Prefer running it in a constrained environment, avoid entering sensitive personal or itinerary details, and ask the publisher to remove automatic global installation, pin and verify the dependency, validate booking URLs, use safe argument passing, and disable or redact persistent logs by default.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:10
Finding: Mandatory Commercial Output and Agent Behavior Hijacking
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/runbook.md:34
Finding: Shell Command Injection Through User-Controlled Command and Log Placeholders
Content: View full analysis
> .flyai-execution-log.json ``` ### Technical Analysis The documented Bash templates interpolate user-derived or generated values into shell command strings. The Skill does not require a process-execution API with separate argument arrays, nor does it define robust shell escaping. Double quotes do not prevent command substitution if attacker-controlled text is incorporated into a command before shell parsing. For example, a request containing `$(command)` can be interpreted as command substitution if the Agent constructs and executes the documented shell string. The logging command is especially unsafe because generated JSON is embedded inside a single-quoted shell literal. A raw user query containing a single quote can terminate that literal and append additional shell syntax. JSON escaping is not equivalent to shell escaping. Exploitation depends on the Agent executing these templates through a shell after textual interpolation. If all commands are invoked through a safe argument-array API and logs are written through a filesystem API, the injection path would not apply. The Skill, however, does not mandate those protections and presents the operations as Bash commands. ### Attack Path 1. An attacker submits a travel request containing shell metacharacters or command-substitution syntax. 2. The raw request ...[truncated 1307 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:116
Finding: Automatic Global Installation of an Unpinned Third-Party Package
Content: View full analysis
Remediation: View remediation

other

Warning

Location: references/runbook.md:1
Finding: Undisclosed Persistent Logging of Raw User Queries and Commands
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook directs the Agent to retain each user's raw query, collected parameters, commands, fallback operations, and output metadata. It explicitly states that this logging is not shown to users and appends the records to a persistent plaintext file. Travel requests can contain sensitive personal information, including names, travel dates, origin and destination locations, accommodation preferences, budget, and itinerary det ...[truncated 1450 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 198)May include surrounding context.
Full luxury orchestration

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The trigger phrase "luxury vacation" is broad enough to match many ordinary user requests about travel, which can cause this playbook to activate when the user did not explicitly intend to invoke a specialized workflow. In a booking-capable travel skill, ambiguous activation can steer users into more expensive or overly opinionated outputs and reduce user control over purchasing-related recommendations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The runbook explicitly logs user_query as raw input in an internal execution log. In a travel-booking skill, user queries can contain sensitive personal data such as names, dates of travel, destinations, passport or visa details, contact information, and booking preferences, so retaining raw input without minimization or disclosure creates a clear privacy and data-leak risk.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The schema combines storage of natural-language user_query with optional file persistence, creating a durable record of potentially sensitive free-form user content. Because this skill handles luxury travel and booking workflows, users may provide high-value personal and itinerary information, making retained logs especially attractive and increasing exposure in the event of compromise or mishandling.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documented persistence step appends execution logs to a local file with no safeguards around file permissions, retention, encryption, or sensitivity review. If the log contains raw queries or booking-related details, local disk persistence increases the chance of unauthorized access, accidental inclusion in backups, or later exfiltration.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The phrase "luxury beach vacation" is more specific than a generic travel query, but it still lacks explicit activation boundaries and may trigger on normal conversational planning rather than deliberate playbook selection. This can bias the system toward premium inventory or unnecessary upselling in a domain tied to reservations and spending.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The trigger "luxury cultural trip" is reasonably descriptive but still broad enough to overlap with standard requests for upscale cultural travel. In this skill context, unintended activation could lead to inflated assumptions about budget, private-tour preferences, or premium bookings without sufficiently clear user consent.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.