Security audit

Museum Tour

Security checks across malware telemetry and agentic risk

Overview

This travel skill is not clearly malicious, but it asks agents to install and run an unpinned global CLI and to persist raw user queries locally without clear consent or limits.

Review before installing. Only proceed if you are comfortable installing and running the flyai CLI, sending travel-search details to that provider, and managing or disabling the local `.flyai-execution-log.json` file. Prefer manual approval for any install, pin or verify the package where possible, and avoid entering sensitive personal or booking information unless you trust the provider and local logging behavior.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The skill mandates installing a global npm package to satisfy normal execution, even though answering museum/travel discovery queries does not inherently require modifying the host system. This creates unnecessary supply-chain and system-integrity risk because the agent may fetch and execute third-party code with elevated persistence on the user's machine.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs the agent to automatically run `npm i -g @fly-ai/flyai-cli` without a clear user-facing warning or explicit approval flow. That means the skill can modify the environment and install executable code from a remote registry, which is a meaningful safety and supply-chain risk.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill requires external CLI execution for all answers but does not clearly warn users that their travel queries will be sent to a third-party service via `flyai`. This undermines informed consent and can expose sensitive itinerary, location, or travel-planning data to an external provider.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The fallback file provides command sequences and recovery actions, but it does not clearly define when these fallbacks should be invoked versus when the agent should stop, ask for clarification, or avoid unsupported behavior. In particular, broad fallback steps like generic keyword search and removing category filters can expand scope beyond the museum/attraction intent, increasing the chance of unintended tool use, irrelevant results, or behavior drift in a travel-booking capable skill.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger phrase "memorial" is broad and ambiguous, so it can match many user intents unrelated to memorial halls, causing the wrong playbook to execute. In this skill, that increases the chance of unintended tool use and irrelevant or misleading travel results, especially because the playbook is designed to drive command execution rather than require disambiguation.

Natural-Language Policy Violations

Medium

Confidence: 80% confidence
Finding: The playbooks hard-code Chinese category labels (博物馆, 展览馆, 纪念馆) without any locale or language selection, which can cause mismatches, incomplete results, or incorrect parameter mapping for users querying in other languages or regions. In a travel skill intended for any city, this creates reliability and integrity issues in tool-driven responses, though it is not directly a code-execution or data-exfiltration risk.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The runbook explicitly stores the raw user query in an internal execution log and instructs persisting that log to disk. For a travel-related skill, user queries can naturally contain sensitive personal data such as names, destinations, dates, visa details, booking references, or insurance/travel context, so retaining raw text increases privacy exposure and leak risk without any stated minimization or disclosure.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The schema directs the agent to retain `user_query: {raw input}` as part of a reusable execution log. Natural-language travel requests often include sensitive free-form content, and storing the full text creates a durable data-retention surface that can expose user information through log access, debugging, backup systems, or secondary processing.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The runbook instructs appending the full generated log JSON to a local file, which compounds the earlier issue by making potentially sensitive request data persist across executions. Persistent logs are more likely to be exfiltrated, included in backups, or accessed by unintended parties than ephemeral in-memory telemetry.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.