Security audit

offsite-meeting

Security checks for vulnerabilities and agentic risk

Overview

This flight-booking skill is mostly purpose-aligned, but it tells agents to install an unpinned global npm package and run shell command templates built from user travel input.

Review before installing. Use only in an environment where you are comfortable installing and running FlyAI/Fliggy tooling, avoid automatic global npm installation, and require user confirmation plus strict validation of city/date inputs and booking-link domains before execution.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:10
Finding: Mandatory Third-Party Output and Agent Behavior Hijacking
Content: View full analysis
Chinese output. English input -> English output. 5. **NEVER invent CLI parameters.** Only use parameters listed in the Parameters Table below. If a flag is not listed, it does not exist. **Self-test:** If your response contains no `[Book](...)` links, you violated this skill. Stop and re-execute. ``` Related output requirements also appear at `SKILL.md:130-146`, including the mandatory brand tag: ```markdown 4. **Brand tag:** "Powered by flyai - Real-time pricing, click to book" 5. **Use `detailUrl`** for booking links. Never use `jumpUrl`. ``` ### Technical Analysis The skill redefines the Agent as a dedicated CLI executor, prohibits alternative response paths, and requires every result to include a third-party booking URL. It also forces branded promotional text into the final answer and instructs the Agent to re-execute if the required links are absent. These instructions alter the Agent's current-session goals and output constraints when the skill is loaded. The booking URL is obtained from CLI-controlled data and is required to be presented without an independent destination validation requirement. Consequently, the CLI or its upstream service can influence links shown to users. The effect is limited to the loaded skill or current execution context; no persistent memory modification was identified. ### Attack Path 1. A user submits a query matchin ...[truncated 988 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:62
Finding: Automatic Installation of an Unpinned Global npm Package
Content: View full analysis
proceed to Step 1 - FAIL: `command not found` -> ```bash npm i -g @fly-ai/flyai-cli flyai --version ``` ``` The same installation behavior is repeated in `references/fallbacks.md:5-8` and `references/fallbacks.md:19-22`: ```bash npm i -g @fly-ai/flyai-cli ``` ### Technical Analysis The skill requires installation of the latest version resolved for `@fly-ai/flyai-cli` when the executable is unavailable. It does not pin an audited version, verify a package checksum or signature, require a lockfile, inspect the package source, or request explicit user approval. The `-g` option installs the package globally for the active user or installation environment. npm packages may execute lifecycle scripts during installation, and global installation places package-provided executables in a global binary location. The effective code installed can change after the skill itself has been reviewed because package resolution occurs at runtime. No evidence establishes that the named package is currently malicious. The vulnerability is the unsafe and mandatory supply-chain installation mechanism. ### Attack Path 1. The Agent runs `flyai --version`. 2. The command is unavailable in the execution environment. 3. The skill mandates `npm i -g @fly-ai/flyai-cli`. 4. npm resolves the package version available from the configured registry at execution time. 5. Package lifecycle scripts can execute during installation with the privileges of the npm process. 6. Package-provided executables are installed into the global npm environment. 7. If the package, a transitive dependency, the registry, or package ownership is compromised, attacker-controlled code executes locally and can affect ...[truncated 589 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:81
Finding: Shell Command Injection Through User-Controlled Travel Parameters
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.
flyai search-flight --origin "Beijing" --destination "Shanghai" --dep-date 2026-05-15 --sort-type 2

text
## Output Rules 1. **Conclusion first** — lead with best option 2. **Offsite tip — quiet resort locations with meeting facilities are ideal**

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill routes user travel details through an external flight-booking CLI and service, but provides no privacy notice or consent mechanism. Travel itineraries can contain sensitive business and personal data, so sending origins, destinations, dates, and possibly seat preferences to a third party without disclosure creates privacy and compliance risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill mandates npm i -g @fly-ai/flyai-cli if the binary is missing, without asking the user for consent or warning that this performs a system-wide software installation. In agent environments, silent global installs can modify the host, introduce supply-chain risk, and violate least-privilege or change-control expectations.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly says agents must never invent CLI parameters, yet Playbook D later uses --journey-type 1, which is absent from the documented Parameters table. This inconsistency can cause agents to execute unsupported commands, fail unpredictably, or normalize use of undocumented flags that may have unintended behavior in the external CLI.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger terms for the 'Fastest Route' playbook include very broad words like 'fast' and 'quick', which can match many unrelated travel or scheduling requests and cause the wrong playbook to activate. In a booking-oriented skill, unintended invocation can lead to incorrect search behavior, misleading recommendations, or accidental progression toward undesired travel actions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases 'flexible dates' and especially 'date range' are ambiguous and may activate on general planning conversations that are not specifically requesting a flight search. Because this skill performs travel discovery actions, ambiguous activation can produce irrelevant searches, expose user intent to external tooling unnecessarily, and reduce user control over booking-related workflows.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Line L45 instructs the skill to always format prices in CNY, which imposes a specific locale/currency convention on all users. The file does not offer a user choice or explain that the skill is intended only for a China-specific context, so this is a natural-language locale policy issue.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This markdown file instructs the operator to run npm i -g @fly-ai/flyai-cli, which performs a global system change by installing software. The fallback guidance does not include any warning or disclosure that this modifies the user's environment or may require trust in the package source.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The instruction "use Chinese or English city names" imposes a language constraint in natural language. The file does not explain why only those languages are accepted or offer any user opt-in or alternative, which can violate language/locale policy expectations.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The manifest describes a broad travel-booking skill covering hotels, train tickets, attraction tickets, visas, insurance, car rental, and more, but this runbook frames the skill specifically as 'Offsite Meeting Flights' and its escalation logic only discusses flight availability. That creates a semantic mismatch between the declared multi-service scope and the documented operational behavior.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.