Security audit

mountain-hotel

Security checks for vulnerabilities and agentic risk

Overview

This travel skill is not clearly malicious, but it should be reviewed because it can install a global CLI automatically and send travel search details to an external service.

Install only if you trust the flyai CLI and are comfortable sending travel search details to its service. Prefer installing a reviewed or pinned CLI version yourself, ideally in an isolated environment, and require confirmation before any package install or external travel search.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The skill explicitly says agents must never invent CLI parameters and may only use flags listed in the Parameters table, but the Direct Route playbook later uses `--journey-type 1`, which is undocumented. This creates an instruction inconsistency that can cause agents to use unsupported or unintended flags, increasing the chance of command misuse, failed execution, or unsafe parameter expansion behavior in wrappers around the CLI.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The activation triggers include broad phrases such as 'find a hotel' and '订酒店', while the skill is described as a specialized mountain-hotel flight booking tool. This can cause the skill to activate for generic travel or lodging requests and unnecessarily route user queries and travel details to the external `flyai` CLI/service, violating least surprise and increasing privacy and mis-execution risk.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill mandates automatic global installation of `@fly-ai/flyai-cli` via `npm i -g` if the CLI is missing, without asking for user approval. Installing software globally changes the execution environment and introduces supply-chain risk, privilege concerns, and unintended system modification from a simple travel request.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill instructs the agent to obtain all answers from the external `flyai` CLI and even install it if absent, but provides no privacy notice or consent step before sending user travel parameters to a third-party service. Travel searches can reveal sensitive itinerary, location, and timing data, so silent transmission increases privacy and compliance risk.

Static analysis

No suspicious patterns detected.