Security audit

Money Exchange

Security checks for vulnerabilities and agentic risk

Overview

The skill is a currency/travel helper, but it asks agents to install a global third-party CLI automatically and persist raw user queries without clear user control.

Review this before installing. Use it only if you are comfortable with a third-party FlyAI CLI being installed and trusted for results, and avoid letting it write logs containing sensitive trip, payment, or personal details. A safer version would require explicit approval before installation, narrow the advertised scope, avoid raw-query persistence, and validate any returned booking links.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:8
Finding: Mandatory Agent Behavior Override and Commercial Link Injection
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:51
Finding: Automatic Installation of an Unpinned Global npm Package
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/runbook.md:7
Finding: Persistent Plaintext Logging of Raw User Queries Through Unsafe Shell Interpolation
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook instructs the agent to include the user's raw input in an execution record and append it to `.flyai-execution-log.json`. There is no consent requirement, data minimization, redaction, retention period, file-permission requirement, or cleanup procedure. Travel queries may contain names, dates, destinations, financial preferences, reservation details, or other sensitive information. The documented persistence command places generated JSON inside a single-quoted shell argument. A raw user query containing a single quote can terminate that quoted context if the plac ...[truncated 1840 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (13)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.
flyai keyword-search --query "汇率日元"

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest claims support for flights, hotels, trains, attraction tickets, itinerary planning, visas, insurance, and car rental, but the actual skill logic only covers exchange-related flyai keyword-search queries. Overstating capabilities is dangerous because an agent may rely on the manifest for tool selection and then execute an ill-suited workflow or fabricate unsupported results to satisfy user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs the agent to install a global npm package if the CLI is missing, without warning the user or requiring consent before modifying the environment. In an agent setting, this is dangerous because it can lead to unapproved code execution and persistent system changes from an external package source.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger phrases include generic terms like "currency" and "how much is," which can match many unrelated travel or commerce questions beyond the narrow exchange-rate scope. Overbroad activation can cause unintended tool use, irrelevant command execution, and user confusion, especially because the skill insists on CLI-backed answers even for queries it cannot properly handle.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill metadata markets broad travel-booking and planning capabilities, but the activation guidance explicitly excludes travel planning and the body only implements currency-related keyword searches. This mismatch can cause an agent to invoke the wrong skill or present unsupported capabilities, increasing the chance of misleading users and unsafe downstream behavior when the agent improvises outside the implemented scope.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The prerequisites section presents npm i -g @fly-ai/flyai-cli as a normal setup step without highlighting that it performs a global installation and changes the host environment. This omission is risky because users and agents may treat it as harmless documentation and execute it automatically, importing unreviewed third-party code with elevated persistence.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The fallback logic directs the agent to automatically run a global npm install when flyai is not found, making environment modification part of normal error recovery. This is particularly dangerous because absence of a dependency becomes a trigger for code acquisition and execution, which expands attack surface and can violate user expectations or platform security policies.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The playbooks embed Chinese query strings such as "汇率", "换汇", and "支付方式" in the command examples, which indicates the skill is forcing a specific language/locale behavior. There is no accompanying explanation that the skill is China-specific or any opt-in mechanism for users who may expect searches in their own language.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The runbook states that the execution log is maintained internally and includes a user_query field containing raw input, but gives no user-facing notice that submitted content may be retained. This creates a privacy vulnerability because users may share sensitive travel, identity, booking, or payment-adjacent details without understanding they are being logged.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The runbook explicitly records the raw user query and detailed execution metadata, then instructs the agent to append that data to a local file if writes are available. For a travel and money-exchange skill, this exceeds what is necessary for normal operation and can expose sensitive itinerary details, financial preferences, destinations, or other personal data through local log access or later reuse.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: By storing raw natural-language user input alongside command history, fallback actions, and output characteristics, the log can capture sensitive context far beyond simple diagnostics. In this skill's travel/booking domain, users may reveal locations, trip dates, companions, visa concerns, or budget details, making the persisted log a meaningful data leakage source if accessed or mishandled.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file persistence section instructs the agent to append execution logs to .flyai-execution-log.json when filesystem writes are available, without warning users that their interaction data may be written to disk. Persistent local storage increases the chance of unintended disclosure through host access, backups, debugging artifacts, or later processing.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file is titled for "currency-exchange" at L01, but the rendered output says "Powered by flyai" (L35) and the failure template instructs users to run a "flyai" CLI command (L58-L61). This is active documentation/output inconsistency that could mislead users about what system or tool is actually being used.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.