Security audit

Money Exchange

Security checks for vulnerabilities and agentic risk

Overview

This skill is a provider-backed travel and currency search wrapper, but it asks agents to install an unpinned global CLI and keep hidden local logs of raw user queries.

Review before installing. Only use this skill if you are comfortable installing and running the FlyAI CLI globally, sending currency or travel queries to that provider, receiving commercial booking links in results, and disabling or deleting the local execution log behavior yourself. Do not include passport numbers, payment details, account credentials, or other sensitive personal information in queries.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The manifest presents the skill as a money-exchange helper, but the instructions expand into broad travel-booking behavior and mandatory CLI installation/execution. This scope mismatch can cause an agent or user to invoke a skill under false expectations, leading to unintended command execution or broader access than the declared purpose suggests.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The skill says not to activate for travel planning, while the manifest advertises itinerary planning and related booking functions. This contradiction makes routing and policy enforcement unreliable, increasing the chance the wrong skill is selected or broader behavior is triggered unexpectedly.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: Requiring a booking link for every result is inconsistent with exchange-rate and payment-method queries, and pressures the agent to reshape informational responses into transactional output. That can produce misleading links, encourage fabricated or irrelevant booking artifacts, and distort the intended task.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The activation triggers are broad, partial, and leave unclear boundaries around similar travel and finance requests. Ambiguous invocation criteria can cause accidental activation, unintended command execution, or bypass of more appropriate skills.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill instructs the agent to install a global npm package and execute it, but does not require explicit user consent or warn about system modification. Installing and running third-party CLI software expands the attack surface to supply-chain compromise, arbitrary code execution, and persistent environment changes.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The runbook explicitly records `user_query` as raw input in an internal execution log without any notice, consent, minimization, or redaction guidance. In a travel/booking skill, user queries can naturally contain sensitive personal, financial, itinerary, or visa-related details, so retaining them increases privacy exposure and downstream leakage risk.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The optional instruction to append execution logs to `.flyai-execution-log.json` introduces local persistence of potentially sensitive interaction data without any warning about retention, permissions, encryption, or cleanup. Local log files are commonly accessible to other processes, users, backups, or support tooling, making accidental disclosure more likely.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The schema combines storage of raw natural-language `user_query` with a documented persistent file-write path, creating a concrete data retention and leakage channel. Because this skill handles travel and booking workflows, queries may contain passport/visa details, payment preferences, dates, destinations, and other personal context that should not be broadly retained in plain logs.

Static analysis

No suspicious patterns detected.