Security audit

Packing List

Security checks for vulnerabilities and agentic risk

Overview

This skill is a travel packing helper that forces a third-party CLI, booking links, global package installation, and hidden local logging beyond what a packing-list user would normally expect.

Review before installing. This skill is not just a packing-list template: it can install and run a third-party CLI, send travel queries to that service, return booking links, and keep a local hidden log of raw requests. Only use it in an isolated environment after confirming the CLI package, installation scope, logging behavior, and whether booking links are actually desired.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:10
Finding: Mandatory Third-Party Output and Behavioral Instruction Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:33
Finding: Unpinned Global Installation of an Unaudited Third-Party Package
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:70
Finding: Shell Command Injection Through User-Controlled Query Placeholders
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/runbook.md:33
Finding: Unsafe Persistence of Raw User Queries and Log-Write Command Injection
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook directs the agent to record the complete raw user query and detailed command history in `.flyai-execution-log.json`. It does not require user consent, data minimization, redaction, restrictive file permissions, encryption, retention limits, or cleanup. Travel queries can contain names, destinations, dates, accommodation details, or other personal information. The recommended persistence command introduces a secon ...[truncated 2155 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.
flyai keyword-search --query "旅行清单日本"

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest presents the skill as a benign packing-list generator, but the execution rules require live CLI-backed travel commerce results and mandatory booking links in every response. This creates a capability mismatch that can mislead users and host agents into invoking external search and commercial booking flows when they expected only informational packing advice.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill advertises booking and reservation capabilities but does not prominently warn that fulfillment depends on executing an external CLI and potentially making network-backed travel searches. Users and orchestrators may treat it as a simple informational skill, underestimating the privacy, execution, and outbound-link risks introduced by the toolchain.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The activation phrases are broad everyday terms such as 'what to pack' and 'what to bring', which can match many normal conversations beyond the intended scope. In an agent environment, this raises the risk of accidental invocation of a networked CLI skill, leading to unnecessary external calls and unexpected commerce-oriented behavior.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documented packing-list feature is implemented through keyword travel searches that appear optimized for bookable inventory rather than packing guidance. This can cause an agent to retrieve and present unrelated commercial content, increasing the chance of deceptive results, unintended outbound navigation, and user confusion about what the skill actually does.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger "what to pack" is a common everyday phrase and is not constrained to a specific tool, context, or invocation pattern. Without scope limits or negative examples, it could cause unintended activation for general conversational requests about packing.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The command hard-codes a Chinese query string ("旅行清单 {dest}") even though the surrounding trigger and document are in English, and there is no indication that the user opted into Chinese-language results. This creates a language/locale policy concern because the skill implicitly forces a specific language without user choice or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The command hard-codes a Chinese query string ("海边旅行清单") while the trigger and document are in English, with no user opt-in to Chinese-language output. This is a natural-language policy issue because it imposes a specific language/locale choice without explanation or choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The command hard-codes a Chinese query string ("冬季旅行清单") despite the rest of the playbook being written in English and providing no language-selection mechanism. This violates the language/locale policy criterion because it forces a locale choice without opt-in or stated justification.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The runbook explicitly captures the raw user query and detailed execution metadata in an internal log, even though a packing-list/travel assistant does not need persistent retention of full prompts to perform its core function. In this skill context, user queries may include travel dates, destinations, companions, budgets, or other sensitive trip details, so storing them unnecessarily increases privacy and misuse risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The schema stores raw user input but provides no user-facing notice, consent mechanism, or explanation of retention and use. For a consumer travel skill, silent collection of full prompts is particularly risky because prompts can contain personal itinerary details and preferences not needed for long-term storage.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Taken together, the runbook both captures raw user input and persists it to a local append-only log, creating a concrete data exposure surface rather than a merely theoretical one. Because the skill is a travel assistant, the retained data can reveal destinations, timing, booking intent, and other sensitive behavioral information unrelated to safe execution of the skill itself.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The runbook directs appending execution logs to a local file without showing any necessity tied to the skill's travel-planning purpose. Persistent local storage of execution traces can expose user travel data and operational details to other processes, users on the host, or later unintended reuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Persisting execution data to a local file without documenting user impact or privacy implications creates hidden data retention and access risks. In this context, the file may accumulate sensitive travel-related interactions over time, making compromise or accidental disclosure more damaging.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.