Security audit

Onsen Hotel

Security checks for vulnerabilities and agentic risk

Overview

This travel-booking skill is mostly coherent, but it asks the agent to install and run a third-party CLI globally and persist raw user travel queries without clear user control.

Review before installing. This skill is designed to send travel searches to FlyAI/Fliggy and produce booking links, which may be acceptable for live hotel booking. The main risks are the automatic global npm install, unsafe shell-style command templates, and persistent hidden logging of raw queries. Use only in an isolated environment or after revising it to require explicit install consent, pinned dependencies, safe argument-array execution, and redacted or disabled logging.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:10
Finding: Agent behavior hijacking through mandatory commercial search and booking-link instructions
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:29
Finding: Automatic installation of an unpinned global npm package
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:95
Finding: Shell command injection through user-controlled travel parameters
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/runbook.md:1
Finding: Unsafe persistence of raw user queries and shell-injectable log data
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook instructs the agent to retain the complete raw user query and generated command strings. Travel requests may contain dates, destinations, accommodation details, budgets, names, or other sensitive contextual information. The design supplies no consent mechanism, minimization policy, retention limit, redaction rules, encryption requirement, or file-permission controls. The persistence example introduces a separate command-injection fla ...[truncated 1745 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.
flyai search-hotel --dest-name "Huangshan" --key-words "温泉" --sort rate_desc --check-in-date 2026-11-01 --check-out-date 2026-11-02

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill mandates live queries through the flyai CLI for all responses, which likely transmits user travel inputs such as destination, dates, and preferences to an external service. Because the skill provides no privacy notice or consent step before sending this data off-system, users may unknowingly disclose itinerary or personal travel information to a third party.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to install and run a global npm CLI (npm i -g @fly-ai/flyai-cli) as part of normal operation, which modifies the host environment and executes third-party code. Without an explicit user-consent and safety warning, this can lead to unintended package installation, supply-chain exposure, or system state changes on the user's machine or agent runtime.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The runbook explicitly includes user_query as raw input in an internal execution log and states the log is not shown to users, with no notice, minimization, or retention controls. In a travel-booking skill, user queries may contain personal, financial, itinerary, passport, or visa-related details, so persistent internal capture increases privacy and data-exposure risk.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The runbook instructs persistent file-based logging of the generated execution log, which contains raw user_query, by appending it to .flyai-execution-log.json. This creates durable storage of potentially sensitive travel-related user data and command history, increasing the blast radius of compromise, insider misuse, and accidental disclosure.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The fallback command hard-codes the hotel type as "民宿", which imposes a specific language/script choice in a natural-language value. The file does not indicate that the user opted into Chinese-language terms or that this locale-specific wording is required for a region-specific workflow.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.