Security audit

multi-airline-compare

Security checks for vulnerabilities and agentic risk

Overview

This flight-comparison skill is not clearly malicious, but it tells the agent to install an unpinned global npm CLI automatically, which is too much system-changing authority without explicit user control.

Review before installing. Use this only if you trust the FlyAI npm package and are comfortable sending route, date, and travel-search details to that provider. Prefer installing the CLI yourself from a trusted source, ideally pinned or sandboxed, and require explicit approval before any global npm install or booking-link action.

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The skill explicitly says to never invent CLI parameters and only use flags listed in the Parameters Table, but Playbook D uses `--journey-type 1`, which is undocumented. This creates a spec inconsistency that can cause unsafe command construction, failed executions, or normalization of undocumented flags that may have other effects in future CLI versions.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The activation trigger includes the broad phrase `multi travel`, which can match many unrelated travel requests and cause this skill to activate outside its intended scope. Because the skill then pushes CLI execution and possible package installation, accidental invocation increases the chance of unnecessary system changes or inappropriate tool use.

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The description advertises hotels, trains, attractions, visas, insurance, and car rental even though the skill body is centered on flight comparison. This scope inflation makes routing ambiguous and may cause the skill to be selected for requests it cannot safely or correctly handle, increasing the risk of inappropriate CLI actions or misleading outputs.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The skill mandates automatic global installation of `@fly-ai/flyai-cli` via `npm i -g` when the tool is missing, without requiring user consent or warning that the host environment will be modified. In an agent setting, this is dangerous because it authorizes persistent system changes and execution of third-party code from the network based solely on prompt-controlled workflow.

Missing User Warnings

Low

Confidence: 95% confidence
Finding: The skill instructs the operator to run `npm i -g @fly-ai/flyai-cli`, which modifies the user's global npm environment without any warning, confirmation, or discussion of trust boundaries. Global package installation executes code from the package lifecycle and can alter system-wide behavior, creating supply-chain and environment-integrity risk even if the intended goal is legitimate.

Static analysis

No suspicious patterns detected.