Security audit

Overnight Flights

Security checks for vulnerabilities and agentic risk

Overview

This travel-search skill is not clearly malicious, but it needs review because it asks agents to install and possibly sudo a global CLI, run shell commands with user input, and persist raw travel queries locally.

Review before installing. Use this only in an isolated environment where the flyai CLI is preinstalled by a trusted administrator, avoid sudo or automatic global npm installs, do not pass untrusted raw city/date text into shell commands, and disable or tightly control the raw query execution log.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:10
Finding: Forced Commercial Provider Use and Promotional Output Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: references/fallbacks.md:5
Finding: Unpinned Global Dependency Installation with Sudo Escalation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/playbooks.md:7
Finding: Shell Command Injection Through User-Controlled Flight Parameters
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/runbook.md:7
Finding: Unsafe Persistent Logging of Raw User Queries with Secondary Command Injection
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook directs the Agent to retain the complete raw user query and detailed command history in a hidden local file. Travel queries may reveal dates, locations, budgets, itinerary information, or other personal data. No consent mechanism, retention period, redaction policy, file permission requirement, encryption control, or deletion procedure is defined. The prescribed persistence command also embeds generated JSON inside a single-quoted shell string. If any logged field contains a single quote, the quote can terminate the shell strin ...[truncated 1848 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 152)May include surrounding context.
flyai search-flight --origin "Beijing" --destination "Shanghai" --dep-date 2026-05-01 --dep-hour-start 21 --sort-type 3

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill instructs installation of a global CLI and escalates to sudo npm i -g, which can modify the host environment with elevated privileges. In an agent or automation context, this is dangerous because it normalizes system-level changes and root execution without warnings, verification steps, sandboxing guidance, or explicit user consent.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 99% confidence
Finding: The explicit recommendation to run sudo npm i -g @fly-ai/flyai-cli is a concrete privilege-escalation risk. Installing packages as root can execute package lifecycle scripts with full system privileges, potentially leading to arbitrary code execution, persistence, or compromise if the package or dependency chain is malicious or tampered with.
Content: Scanner excerpt · references/fallbacks.md (reported line 10)May include surrounding context.
bash
npm i -g @fly-ai/flyai-cli flyai --version # Fails → sudo npm i -g @fly-ai/flyai-cli # Still fails → STOP. Do NOT answer with training data.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The manifest centers this skill on finding overnight and late-night departure flights, but the fallback instructions broaden behavior to a generic flight keyword search and suggest rail alternatives when no flights are found. That goes beyond an implementation detail of overnight-flight discovery and materially expands the skill's operational scope.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The manifest advertises a niche capability for overnight and late-night departures, but these fallback steps include general flexible-date and max-price flight searches that are not limited to overnight travel. Only one step explicitly tries a red-eye; the others broaden into standard flight-shopping behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The runbook explicitly logs the raw user_query, which can contain sensitive personal, travel, payment-adjacent, or identity information. Because the document says this log is internal and not shown to users, there is no transparency or consent mechanism, creating a real privacy and data-retention risk.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Taken together, the schema stores raw user_query and then documents persisting the resulting log to disk, creating a complete plaintext audit trail of user inputs and operational activity. In a travel-booking context, queries may include names, dates, destinations, visa details, and other sensitive itinerary information, making the privacy impact materially higher.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The runbook instructs appending execution logs to a local file without safeguards, which creates persistent storage of potentially sensitive operational and user-derived data. Unbounded plain-file logging can expose data to other local users, backups, or later compromise, especially if permissions, rotation, and retention are not controlled.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation first instructs the skill not to search for a passed date, then immediately says to auto-search tomorrow. Those two directives are in direct tension, creating intent ambiguity about whether the skill should refrain from searching or silently alter the user's date.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.