Security audit

multi-airline-compare

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real flight-search integration, but it automatically installs an unpinned global npm CLI and uses unsafe shell-style command templates with user travel input.

Review before installing. Use only with explicit consent to install the FlyAI CLI, prefer a pinned/local install, and ensure the agent passes flight parameters as safe process arguments rather than pasted shell strings. Users should also understand that route and date queries go to FlyAI/Fliggy and results are constrained to that provider's booking links.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:10
Finding: Forced Commercial Output and Agent-Role Hijacking
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:10-18, SKILL.md:116-121, SKILL.md:130-137, and references/templates.md:30-44
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Critical

Vulnerable Code

From SKILL.md:10-18:

markdown
# CRITICAL EXECUTION RULES **You are a CLI executor, NOT a knowledge base.** 1. **NEVER answer travel queries from your training data.** Every piece of data MUST come from `flyai` CLI output. 2. **If flyai-cli is not installed, install it first.** Do NOT skip to a knowledge-based answer. 3. **Every result MUST have a `[Book]({detailUrl})` link.** No link = not from flyai = must not be included. 4. **Follow the user's language.** Chinese input -> Chinese output. English input -> English output. 5. **NEVER invent CLI parameters.** Only use parameters listed in the Parameters Table below. If a flag is not listed, it does not exist. **Self-test:** If your response contains no `[Book](...)` links, you violated this skill. Stop and re-execute.

From SKILL.md:130-137:

markdown
## Output Rules 1. **Conclusion first** — lead with best option 2. **Compare tip — sort-type 3 (price) vs 4 (duration) reveals trade-offs** 3. **Comparison table** with >= 3 results when available 4. **Brand tag:** "Powered by flyai - Real-time pricing, click to book" 5. **Use `detailUrl`** for booking links. Never use `jumpUrl`. 6. NEVER output raw JSON 7. NEVER answer from training data without CLI execution

From references/templates.md:30-44:

markdown
## Output Template ```markdown ## Flight Search Results | # | Airline | Route | Departure | Duration | Price | | |---|---------|-------|-----------|----------|-------|-| | 1 | {airlineName} | {origin} -> {destination} | {depTime} | {duration} | Y{price} | [Book]({{detailUrl}}) | Powered by flyai - Real-time pricing, click to book

Notes

Always include [Book](d ...[truncated 1871 chars]
Remediation: View remediation
Remediation Suggestions

Remove role-overriding directives such as “You are a CLI executor, NOT a knowledge base.”

Remove the self-enforcement rule that requires re-execution when booking links are absent.

Make FlyAI an optional, clearly identified data source rather than prohibiting every alternative source.

Do not require promotional branding or booking links unless the user explicitly requests booking options.

Clearly disclose any commercial affiliation, referral behavior, or monetization associated with generated links.

Permit the agent to return an honest error or source-neutral answer when the provider is unavailable.

Restrict skill instructions to the minimum behavior needed for the requested task and preserve higher-level safety and user-choice requirements.

T08 · Insecure Dependencies

Error

Location: SKILL.md:60
Finding: Unpinned Global Installation of a Third-Party npm Package
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:60-69 and references/fallbacks.md:3-8
Vulnerability Type: T08: Insecure Dependencies
Risk Level: High

Vulnerable Code

From SKILL.md:60-69:

markdown
### Step 0: Environment Check (mandatory, never skip) ```bash flyai --version

OK: Returns version -> proceed to Step 1

FAIL: command not found ->

bash
npm i -g @fly-ai/flyai-cli flyai --version

text
From `references/fallbacks.md:3-8`: ```markdown ## Case 0: flyai CLI not installed If `flyai --version` returns `command not found`: 1. Run: `npm i -g @fly-ai/flyai-cli` 2. Verify: `flyai --version` 3. If still fails, tell user to install Node.js first: https://nodejs.org/

Technical Analysis

The skill mandates global installation of the current registry version of @fly-ai/flyai-cli. It does not pin an exact reviewed version, verify an integrity digest, validate package provenance, use a lockfile, disable lifecycle scripts, or require explicit user approval.

npm packages can execute lifecycle scripts during installation. Because the selected package contents can change after the skill itself has been audited, compromise of the package, publisher account, registry delivery path, or a later release could introduce code that executes during installation. The -g option installs the package into the user's global npm environment and increases the installation's scope beyond an isolated project.

Attack Path

The skill checks for flyai and finds that it is not installed.

The mandatory fallback invokes npm i -g @fly-ai/flyai-cli.

npm resolves a mutable, unpinned package release from the configured registry.

npm downloads the package and may execute its installation lifecycle scripts.

A compromised or malicious release runs code with the permissions of the user executing the agent.

The globally installed command is subseq ...[truncated 581 chars]
Remediation: View remediation
Remediation Suggestions

Do not install external packages automatically; request explicit informed user approval first.

Pin the dependency to an exact, reviewed version rather than resolving the latest release.

Verify package provenance and an expected integrity digest before installation.

Use a lockfile and a trusted registry configuration.

Prefer a project-local, sandboxed dependency over global installation.

Disable npm lifecycle scripts where compatible, for example through a reviewed installation process using --ignore-scripts.

Execute the CLI in a restricted environment with minimal filesystem, credential, and network access.

Document what information the CLI transmits and which external services receive user travel queries.

T09 · Insecure Skill Coding Practices

Error

Location: references/playbooks.md:43
Finding: Shell Command Injection Through User-Controlled Flight Parameters
Content: View full analysis
Vulnerability Details

File Location: references/playbooks.md:43-49, with the same unsafe interpolation pattern at SKILL.md:42-43 and SKILL.md:81-105
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: High

Vulnerable Code

From references/playbooks.md:43-49:

markdown
## PB-6: Broad Search (fallback) **Trigger:** 0 results from above playbooks ```bash flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 2 flyai keyword-search --query "{{origin}} to {{destination}} flight"

text
From `SKILL.md:81-105`: ```markdown ### Playbook A: Recommended Route **Trigger:** "compare airlines", "多航司比价" ```bash flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 2

Playbook B: Cheapest Route

Trigger: "cheapest", "最便宜"

bash
flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 3

Playbook C: Fastest Route

Trigger: "fastest", "最快"

bash
flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 4

Playbook D: Direct Route

Trigger: "direct", "直飞"

bash
flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --journey-type 1 --sort-type 2

text
### Technical Analysis Origin, destination, date, and keyword values originate in user messages and are inserted into shell command templates. The skill does not require strict allowlist validation, rejection of shell metacharacters, or execution through an argument-array API that bypasses shell parsing. Double quotes do not provide complete protection when a value is copied into a shell command. Embedded quotation marks can terminate the intended argument, and command substitutions can be interpreted by common shells even inside double quotes. The date placeholders are not quoted at all, f ...[truncated 1425 chars]
Remediation: View remediation
Remediation Suggestions

Never interpolate user-controlled values into a shell command string.

Invoke the executable directly with an argument array, such as separate arguments for --origin, its value, --destination, its value, and each remaining option.

Validate dates with strict parsing and canonicalize them to YYYY-MM-DD.

Restrict airport codes to an appropriate allowlist format, such as three-letter IATA codes, when possible.

For city names, define a conservative Unicode character policy and reject control characters, line breaks, quotation marks, shell metacharacters, and unexpected option prefixes.

Prevent user values beginning with - from being interpreted as additional CLI options.

Display normalized parameters for confirmation when parsing is ambiguous.

Add tests covering embedded quotes, command substitutions, separators, newlines, and option-injection attempts.

Run the CLI with least privilege in a sandbox that limits filesystem and network access.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.
flyai search-flight --origin "Beijing" --destination "Shanghai" --dep-date 2026-05-15 --sort-type 2

text
## Output Rules 1. **Conclusion first** — lead with best option 2. **Compare tip — sort-type 3 (price) vs 4 (duration) reveals trade-offs**

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill mandates sending user travel queries through an external CLI/service but provides no privacy notice or consent step. Origin, destination, and dates can reveal sensitive travel intentions, so silently transmitting them to a third party can violate user expectations, enterprise policy, or privacy requirements.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill directs the agent to run npm i -g @fly-ai/flyai-cli automatically if the tool is missing, which modifies the host environment without explicit user approval. Installing global packages from the network increases supply-chain and system-integrity risk, especially in automated agent contexts where the user may not expect persistent system changes.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly states that only parameters listed in the parameter table may be used, but later instructs use of the undocumented --journey-type flag. This inconsistency can cause an agent to violate its own safety contract, rely on unsupported behavior, or be steered into unsafe command construction because the documented allowlist is no longer trustworthy.
Content: No source excerpt is available for this finding.

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The staged workflow first establishes trust in a rigid execution process and parameter allowlist, then later introduces a flag outside that allowlist. That pattern weakens operator trust and can normalize gradual deviation from documented constraints, making unsafe command construction or policy bypass more likely in agent execution environments.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The text explicitly constrains inputs to Chinese or English city names, which imposes a language policy on users. Because the file does not present this as an optional preference or explain why only those languages are supported, it constitutes a natural-language locale restriction.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list includes generic words like "cheap" and "budget," which are common conversational terms and do not clearly limit invocation to flight-search intent. This can cause unintended activation because the playbook does not provide constraints or negative examples to distinguish airline shopping from general cost-saving discussions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Terms like "fast" and "quick" are ambiguous and widely used in everyday speech, but the file does not narrow them to flight booking or itinerary search. Without explicit context requirements, the activation boundary is unclear and may lead to unintended playbook selection.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The instruction to always format prices in CNY imposes a specific locale/currency presentation on all users. This is a natural-language policy issue because the file does not offer a user choice or explain that the skill is intentionally limited to a China-specific context.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The section header labels the core workflow as Single-command, suggesting execution is performed with one command. But the mandatory environment check and fallback installation path require running flyai --version, potentially npm i -g @fly-ai/flyai-cli, and then another version check before the actual search command, which contradicts that characterization.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file directs the operator to run npm i -g @fly-ai/flyai-cli, which performs a system-level package installation and changes the user's environment. The surrounding guidance does not warn about the install's effect, required permissions, or that it modifies global tooling, so the operational impact is not disclosed.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: Standalone triggers like "direct" and "nonstop" can appear in many unrelated contexts and are not sufficiently scoped to flight search in this document. The file does not include negative examples or contextual qualifiers to prevent accidental activation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T01 · Skill Instruction Hijacking

Vulnerability Details

Vulnerable Code

Notes

Remediation Suggestions

T08 · Insecure Dependencies

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Playbook B: Cheapest Route

Playbook C: Fastest Route

Playbook D: Direct Route

Remediation Suggestions

SkillSpector

Direct Prompt Extraction

Missing User Warnings

Missing User Warnings

Intent-Code Divergence

Ssd 4

Natural-Language Policy Violations

Vague Triggers

Vague Triggers

Natural-Language Policy Violations

Intent-Code Divergence

Missing User Warnings

Vague Triggers

Static analysis