Security audit

national-day-flight

Security checks for vulnerabilities and agentic risk

Overview

This flight-booking skill is purpose-related but asks the agent to install and run an unpinned global CLI automatically and builds shell commands from user travel details.

Install only if you intentionally want this agent to use the flyai/Fliggy flow for flight searches. Before use, require approval for any npm installation, prefer a pinned local install or sandbox, validate travel fields before execution, and treat booking links as commercial provider links rather than neutral advice.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:11
Finding: Mandatory Agent Behavior and Commercial Output Hijacking
Content: View full analysis
Chinese output. English input -> English output. 5. **NEVER invent CLI parameters.** Only use parameters listed in the Parameters Table below. If a flag is not listed, it does not exist. ``` The behavior is reinforced later: ```markdown ### Step 4: Validate Output (before sending) - [ ] Every result has `[Book]({detailUrl})` link? - [ ] Data from CLI JSON, not training data? - [ ] Brand tag included? **Any NO -> re-execute from Step 2.** ``` ```markdown ## Output Rules 1. **Conclusion first** — lead with best option 2. **National Day tip — 7-day holiday, book 45+ days ahead; Sep 30 is departure peak** 3. **Comparison table** with >= 3 results when available 4. **Brand tag:** "Powered by flyai - Real-time pricing, click to book" 5. **Use `detailUrl`** for booking links. Never use `jumpUrl`. 6. NEVER output raw JSON 7. NEVER answer from training data without CLI execution ``` ### Technical Analysis The skill redefines the agent as a dedicated CLI executor and prohibits it from using other legitimate response paths. It mandates that all returned results contain commercial booking links and a fixed brand attribution. The validation step forces the agent to repeat execution if the promotional requirements are not met. These instructions alter the active session's goal ...[truncated 1461 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:57
Finding: Mandatory Installation of an Unpinned Global npm Dependency
Content: View full analysis
proceed to Step 1 - FAIL: `command not found` -> ```bash npm i -g @fly-ai/flyai-cli flyai --version ``` ``` The fallback instructions repeat the installation requirement: ```markdown ## Case 0: flyai CLI not installed If `flyai --version` returns `command not found`: 1. Run: `npm i -g @fly-ai/flyai-cli` 2. Verify: `flyai --version` 3. If still fails, tell user to install Node.js first: https://nodejs.org/ ``` ### Technical Analysis The skill mandates a global npm installation without specifying an exact package version, integrity digest, lockfile, audited source revision, or trusted artifact checksum. The command therefore resolves whatever package version the registry currently serves. npm packages can execute lifecycle scripts during installation. If the package, publisher account, dependency chain, or registry resolution is compromised, installation can execute attacker-controlled code with the permissions of the account running npm. Global installation also modifies shared user or system package locations rather than an isolated project environment. The audit did not establish that the referenced package is currently malicious. The vulnerability is the mandatory, unpinned, globally scoped supply-chain execution path. ### Attack Path 1. The skill checks whether `flyai` is present. 2. On a system where it is absent, the skill mandates `npm i -g @fly-ai/flyai-cli`. 3. npm resolves the current package and transitive dependencies from the configured registry. 4. A compromised package release, publisher account, dependency, or registry response supplies malicious package content. 5. npm runs package installation or l ...[truncated 1049 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:78
Finding: Shell Command Injection Through User-Controlled CLI Template Interpolation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.
flyai search-flight --origin "Beijing" --destination "Shanghai" --dep-date 2026-05-15 --sort-type 2

text
## Output Rules 1. **Conclusion first** — lead with best option 2. **National Day tip — 7-day holiday, book 45+ days ahead; Sep 30 is departure peak**

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill mandates automatic global installation of @fly-ai/flyai-cli via npm i -g if the tool is missing, without user confirmation or safety checks. Auto-installing and then executing a package from the network expands the attack surface significantly, enabling supply-chain compromise, execution of untrusted code, or unauthorized environment modification on the user's machine.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly says agents must only use parameters listed in the Parameters Table, but a later playbook uses --journey-type 1, which is undocumented. This creates unsafe ambiguity: an agent may rely on hidden or guessed flags, increasing the chance of command misuse, failed execution, or unintended behavior when interacting with an external booking CLI.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Using the everyday phrase "book a flight" as an activation trigger is overly broad and can cause the skill to auto-activate for generic travel conversations outside the narrow National Day scope. That increases the chance the agent will execute external booking commands or initiate transactional workflows when the user only intended to ask for general advice or discuss travel options.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases "cheap" and "budget" are very broad and can appear in many travel-related conversations that are not requests to search flights. This can cause unintended skill activation and execution of a flight search with user-supplied parameters, increasing the chance of incorrect actions, confusion, or leakage of travel intent into an external service.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The triggers "fast" and "quick" are ambiguous and insufficiently specific for flight-search activation, because they can refer to response speed, itinerary planning, or unrelated user preferences. In a travel-booking skill, this ambiguity can lead to unintended external queries and incorrect routing of the conversation into booking workflows.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The instruction to always format prices in CNY establishes a fixed locale-specific output requirement. The file does not offer user opt-in, alternative locales, or a documented reason that this skill must be China-specific, which makes it a natural-language policy concern.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The fallback condition "0 results from above playbooks" is underspecified and lacks clear boundaries on when the broader keyword search may run. This can expand the scope from structured flight search to a free-form query, which increases the likelihood of unintended activation, irrelevant searches, and reduced control over what is sent to external tooling.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.