Security audit

multi-city

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a flight-search helper, but it also directs automatic global CLI installation and local storage of raw travel requests without clear user control.

Review before installing. Use it only if you trust the flyai CLI and are comfortable sharing itinerary searches with that provider. Prefer installing and reviewing the CLI yourself instead of allowing automatic global installation, and disable or delete `.flyai-execution-log.json` if you do not want raw travel requests stored locally.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The skill explicitly states that unlisted CLI flags must never be used, yet later instructs use of `--transfer-city`, which is absent from the documented parameter table. This inconsistency can cause an agent to invoke unsupported or unintended CLI behavior, increasing the risk of command misuse, failed execution, or unsafe parameter expansion if the CLI interprets unknown flags unexpectedly.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill mandates `npm i -g @fly-ai/flyai-cli` when the tool is missing, which instructs the agent to modify the host environment automatically. Automatic global package installation is risky because it changes system state, may require elevated privileges, and pulls executable code from an external registry without explicit user approval at execution time.

Vague Triggers

Medium

Confidence: 79% confidence
Finding: The fallback trigger 'Complex route not directly supported' is broad, and the command interpolates user-derived route text into a generic keyword query. Ambiguous fallback logic can cause the agent to invoke overly permissive search behavior, increasing the chance of unintended tool use, poor query scoping, or prompt-like text being forwarded into downstream systems.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The runbook explicitly stores the raw user query in an internal execution log and states that the log is not shown to users. In a travel-booking skill, raw input can contain names, passport or visa details, dates of birth, contact information, loyalty numbers, and other sensitive itinerary data, so retaining it without notice, minimization, or redaction creates a meaningful privacy and data-exposure risk.

Ssd 3

Medium

Confidence: 88% confidence
Finding: The logging rules require recording every CLI call, fallback, and output metadata, while also surfacing some `risk_flags` to users. This creates a detailed operational audit trail that may capture sensitive internal behavior and user-derived data without any privacy boundaries, and the travel context increases risk because requests often include PII and booking details across multiple legs.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The runbook directs appending generation logs to a local file with no constraints on sanitization, permissions, encryption, rotation, or retention. Persisting cumulative execution logs in a local JSON file increases the chance of sensitive travel and booking data being exposed to other processes, operators, backups, or later compromise of the host environment.

Static analysis

No suspicious patterns detected.