Security audit

Museum Tour

Security checks for vulnerabilities and agentic risk

Overview

This skill needs review because it can install and run an external travel CLI, force booking links and branding, and store raw user requests without clear consent.

Install only if you are comfortable with a skill that may install a global third-party npm CLI, run shell commands for travel searches, show third-party booking links, and keep local plaintext execution logs. Prefer running it in an isolated workspace or container, approve package installation manually, and avoid entering sensitive travel, identity, payment, or itinerary details unless logging is removed or disabled.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:10
Finding: Mandatory Agent Role Override and Commercial Output Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:36
Finding: Unpinned Global Installation of a Third-Party CLI Package
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:78
Finding: Shell Command Injection Through User-Controlled Search Parameters
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/runbook.md:3
Finding: Unsafe Plaintext Logging of Raw Queries and Commands
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook instructs the agent to retain the raw user query, complete commands, timestamps, fallback activity, and output metadata in `.flyai-execution-log.json`. No consent requirement, redaction policy, restrictive file permissions, retention limit, rotation policy, or deletion procedure is defined. Raw travel queries may contain names, intended locations, dates, itinerary details, or other personal information. Storing ...[truncated 1979 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.
flyai search-poi --city-name "Beijing" --category "博物馆"

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The playbooks hardcode Chinese category labels for all searches without documenting that the backend expects Chinese taxonomy or that the skill is limited to a compatible locale. In non-Chinese cities or multilingual contexts, this can return poor, incomplete, or misleading results, causing silent failure or quality degradation that users cannot easily detect.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger phrase "art gallery" is broad enough to match ordinary conversation that may not be an explicit request to invoke this skill. That can cause unintended activation and execution of the associated POI search command, leading to irrelevant tool use, confusion, and possible overreach in mixed travel-planning contexts.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger phrase "memorial" is highly vague and may refer to events, people, days of remembrance, or historical discussion rather than venue search. This increases the risk of accidental skill activation and incorrect command execution, especially in conversational settings where the word appears outside a travel-search intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The runbook explicitly records user_query as raw input and appends the log to a local file, creating unnecessary retention of potentially sensitive natural-language data. In a travel skill, user queries may include destinations, dates, names, visa details, booking preferences, or other personal information, so persistent plaintext logging increases privacy and leakage risk if the host, workspace, or logs are accessed by unauthorized parties.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This schema persists raw natural-language queries to .flyai-execution-log.json, which can capture sensitive freeform data that users may provide incidentally or directly. Because the skill supports travel-related tasks such as flights, hotels, visas, and insurance, the logged text may contain personal, financial, or itinerary details, making retention more dangerous than in a low-sensitivity context.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This markdown file includes a natural-language fallback step saying to try Chinese/English variants, but it does not specify when to use each variant, what forms are allowed, or any exclusion conditions. The lack of specificity could lead to inconsistent or overly broad behavior when resolving city names.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.