Security audit

Mini Trip

Security checks for vulnerabilities and agentic risk

Overview

This travel skill is purpose-aligned, but it asks the agent to install and run an unpinned global CLI and to persist raw user travel queries in a hidden local log.

Review before installing. Only use this skill if you trust the flyai CLI and are comfortable sending travel queries to that provider. Do not allow automatic global npm installation; install a reviewed, pinned version in a contained environment. Disable or remove the hidden execution log, especially the raw `user_query` field and shell-based append command.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:8
Finding: Forced Commercial Provider Routing and Agent Role Override
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:125
Finding: Automatic Installation of an Unpinned Global npm Package
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/runbook.md:31
Finding: Shell Injection and Sensitive-Query Exposure in Execution Logging
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The log schema stores the complete raw user query, collected parameters, commands, and recovery commands in a persistent hidden file. The instructions provide no consent requirement, data minimization, redaction policy, retention period, file-permission requirement, or secure deletion mechanism. Travel queries may contain names, dates, destinations, accommodation details, budget information, or other personal data. The proposed persistence command also places generated JSON inside a single-quoted shell argument: ```bash echo '{generation_log_json}' >> .flyai-execution-log.json ``` If `{generation_log_json}` contains an apostrophe derived from raw user input, the shell's single-quoted context terminates early. Additional shell metacharacters in atta ...[truncated 2245 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.
flyai search-flight --origin "Beijing" --destination "Shanghai" --dep-date 2026-05-01 --back-date 2026-05-03 --sort-type 3

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill mandates calling an external CLI for all travel responses but does not disclose that user itinerary, dates, locations, and possibly personal travel preferences may be sent to a third-party service. This creates a privacy and transparency risk because users are not informed that their query data may leave the local environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs the agent/user to install a global npm package and execute it, but provides no safety warning, provenance guidance, or least-privilege advice. This is dangerous because global package installation runs untrusted third-party code with the user's privileges and can modify the environment persistently.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file states that the agent maintains an internal log not shown to users, while the schema includes the raw input field user_query. This means user-supplied content may be captured invisibly, undermining transparency and informed consent, especially in a travel context where queries can contain names, dates, locations, passport/visa concerns, or other personal details.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The runbook explicitly records the raw user query and detailed per-step execution metadata, including commands, statuses, and timing. For a travel-planning/booking skill, this creates unnecessary retention of potentially sensitive user data such as itinerary details, booking intents, destinations, dates, and possibly personal or financial context, increasing privacy and misuse risk without clear necessity.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The runbook directs persistent append-only filesystem storage of execution logs, which can accumulate sensitive travel and booking-related data over time. Persisting this information to local disk without a demonstrated business need, access controls, encryption, or retention policy materially increases the chance of unauthorized disclosure or later misuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The persistent append to a local execution log is described without any warning that user-related data may be written to disk. Because earlier sections include raw user queries and detailed execution records, this omission hides a meaningful privacy and data-handling behavior from users and operators, making accidental overcollection and exposure more likely.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.