Security audit

nightlife-trip

Security checks for vulnerabilities and agentic risk

Overview

The skill is a flight-search helper, but it requires automatic global installation of an unpinned npm CLI and executes user-derived shell command templates with weak scoping.

Review before installing. This skill may download and globally install a third-party npm CLI, make live travel-search requests, and present provider booking links. Only use it in an environment where global package installation is allowed, and avoid passing untrusted free-form input unless the executor validates parameters safely.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:9
Finding: Forced Commercial Output and Booking-Link Injection
Content: View full analysis
Chinese output. English input -> English output. 5. **NEVER invent CLI parameters.** Only use parameters listed in the Parameters Table below. If a flag is not listed, it does not exist. **Self-test:** If your response contains no `[Book](...)` links, you violated this skill. Stop and re-execute. ``` ```markdown ## Output Rules 1. **Conclusion first** — lead with best option 2. **Nightlife tip — Bangkok, Tokyo, and Shanghai are top nightlife cities** 3. **Comparison table** with >= 3 results when available 4. **Brand tag:** "Powered by flyai - Real-time pricing, click to book" 5. **Use `detailUrl`** for booking links. Never use `jumpUrl`. 6. NEVER output raw JSON 7. NEVER answer from training data without CLI execution ``` Related mandatory branding and link behavior also appears in `references/templates.md:29-44`. ### Technical Analysis The Skill replaces the agent's normal response behavior with rigid instructions requiring use of a proprietary CLI, inclusion of commercial booking links, and insertion of third-party branding. It further instructs the agent to stop and re-execute if a booking link is absent. This is instruction hijacking because loading the Skill changes the current session's goals from assisting the user neutrally to enforcing a specific third-party data source and promotional output. The ...[truncated 1306 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:91
Finding: Shell Command Injection Through User-Controlled Travel Parameters
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:65
Finding: Mandatory Unpinned Global Installation of a Third-Party npm Package
Content: View full analysis
proceed to Step 1 - FAIL: `command not found` -> ```bash npm i -g @fly-ai/flyai-cli flyai --version ``` Still fails -> **STOP.** Do NOT continue. Do NOT use training data. ``` The installation is repeated in `references/fallbacks.md:3-9` and `references/fallbacks.md:20-23`: ```bash npm i -g @fly-ai/flyai-cli ``` ### Technical Analysis The Skill mandates installation of the latest registry version of `@fly-ai/flyai-cli` whenever the command is absent. No exact version, lockfile, integrity hash, package provenance check, signature verification, or approved registry configuration is provided. A global npm installation expands the effect beyond the project directory by placing executable components into a shared system or user-level location. npm packages can also define lifecycle scripts that run during installation. Therefore, a compromised package version, registry account, dependency, or registry configuration could execute code during installation and leave a globally available executable for subsequent sessions. The audit did not establish that the named package is currently malicious. The vulnerability is the unsafe and mandatory supply-chain installation pattern. ### Attack Path 1. The target environment does not already contain the `flyai` executable. 2. Loading the Skill causes the mandatory environment check to fail. 3. The agent executes `npm i -g @fly-ai/flyai-cli` without seeking user approval. 4. npm resolves the current package version and its transitive dependencies from the configured registry. 5. Any package lifecycle scripts run with the privileges of the npm process. 6. Package binaries are installed globally or into the account's global npm prefix. 7. T ...[truncated 1133 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.
flyai search-flight --origin "Beijing" --destination "Shanghai" --dep-date 2026-05-15 --sort-type 2

text
## Output Rules 1. **Conclusion first** — lead with best option 2. **Nightlife tip — Bangkok, Tokyo, and Shanghai are top nightlife cities**

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs the agent to install @fly-ai/flyai-cli globally via npm if the tool is missing, without warning the user that this modifies the host environment. Allowing a skill to trigger persistent package installation increases supply-chain and system-integrity risk, especially because the package is fetched from an external registry and installed with global scope.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly says to never invent CLI parameters, but later introduces undeclared flags such as --journey-type, --dep-hour-start, and --dep-hour-end that are not listed in the Parameters table. This inconsistency can cause an agent to execute unsupported commands, fail unpredictably, or start guessing behavior from undocumented inputs, undermining safe and deterministic tool use.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The activation trigger includes the broad phrase plan a trip, which can match many ordinary travel requests unrelated to nightlife. In an agent setting, overly broad routing can invoke this skill in the wrong context and push unnecessary CLI execution or booking-oriented behavior when a narrower skill should handle the request.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The environment-check workflow operationalizes a global npm install as part of normal execution, meaning a simple user query can cause persistent changes to the machine. In agent environments this is dangerous because it turns routine skill activation into unreviewed code acquisition and installation from the network.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases in PB-2 and PB-3 include very common terms such as "cheap," "budget," "fast," and "quick," which can match routine user language outside a clearly flight-specific intent. In an agent setting, this can cause unintended playbook activation and execution of travel-search actions when the user did not mean to invoke this skill, creating misrouting, privacy leakage through unnecessary query construction, or confusing downstream automation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The fallback condition "0 results from above playbooks" is underspecified because it does not define ranking, retries, validation boundaries, or when it is safe to broaden the search. This can cause the agent to invoke a looser keyword search unexpectedly, potentially expanding scope beyond the original structured request and returning irrelevant or unintended results based on free-form query construction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The template hard-codes Chinese yuan formatting ('Y{price}') and instructs the agent to always present prices in CNY regardless of the user's locale or preferences. In a travel-booking context, this can mislead users about actual costs, create pricing confusion, and increase the risk of mistaken purchases, especially for international users expecting localized currency or explicit currency labels.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.