Security audit

offsite-meeting

Security checks across malware telemetry and agentic risk

Overview

This flight-search skill is mostly coherent, but it needs Review because it tells agents to install and run an unpinned global third-party CLI without an explicit consent gate.

Install only if you are comfortable with an agent installing a global npm package and sending flight-search details to flyai/Fliggy. Prefer manually reviewing and installing a pinned CLI version first, and use this skill only for flight search rather than the broader travel services mentioned in the description.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The skill explicitly says to never invent CLI parameters, yet later uses `--journey-type 1` in a playbook even though that flag is absent from the declared Parameters table. This creates an inconsistency that can cause agents to trust undocumented flags, increasing the chance of command misuse, failed execution, or unsafe parameter expansion in adjacent tooling.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill directs the agent to install and execute a global npm package (`npm i -g @fly-ai/flyai-cli`) as part of normal operation without any warning, consent, or sandboxing guidance. Installing software modifies the host environment and executes third-party code, which can expose the system to supply-chain compromise or unintended persistence.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill is designed to send travel-search inputs such as origin, destination, and dates to an external provider via CLI, but it provides no privacy notice or consent step. Travel data can reveal sensitive business plans, employee movement, or executive travel patterns, especially in an offsite-meeting context.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger set for the cheapest-flight playbook includes very broad terms like "cheap" and "budget", which can appear in many unrelated user utterances. In a travel-booking skill, this can cause unintended invocation of a pricing-focused workflow and lead to irrelevant searches, mistaken recommendations, or actions taken under the wrong user intent.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The speed-related triggers use generic words like "fast" and "quick", which are ambiguous and may match many requests not specifically asking for the fastest flight. In this travel skill, such ambiguity increases the chance of routing the user into the wrong playbook, producing unsuitable results or initiating downstream booking logic based on misclassified intent.

Ssd 4

Medium

Confidence: 90% confidence
Finding: The opening rules strongly coerce the agent into a tool-only workflow and prohibit safer fallback behavior, pushing it toward installing and running an external CLI before answering. This kind of narrative can bypass normal caution and make dangerous environment changes seem mandatory for a routine travel task.

Ssd 4

Medium

Confidence: 96% confidence
Finding: The environment-check sequence instructs the agent to test for a command and then automatically perform a global install if missing. This is more dangerous than ordinary documentation because it embeds software installation into a mandatory, benign-looking workflow, increasing the likelihood that agents execute unreviewed third-party code on the host.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.