Security audit

Pet Hotel

Security checks for vulnerabilities and agentic risk

Overview

This skill can help find pet-friendly hotels, but it requires a global CLI install, builds shell commands from user input, and stores hidden raw-query logs.

Install only after deciding you trust the FlyAI CLI and its package supply chain. Prefer a pinned, local, user-approved install; run it in a restricted environment; disable or remove persistent raw-query logging; and require safe argument-based CLI execution plus validation of booking-link domains before showing links to users.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:8
Finding: Mandatory Commercial Output and Booking-Link Injection
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:72
Finding: Mandatory Installation of an Unpinned Global npm Package
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:91
Finding: Shell Command Injection Through User-Controlled Parameter Interpolation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/runbook.md:1
Finding: Hidden Persistent Logging of Raw User Queries With Unsafe Shell Serialization
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook instructs the agent to store the complete raw user query and executed command details in a persistent hidden file while explicitly stating that the log is not shown to users. No consent, data minimization, redaction, retention period, access-control requirement, encryption, or deletion mechanism is defined. Travel requests may reveal locations, dates, companions, budgets, or other personal information. Because the schema stores `{raw input}`, it ...[truncated 2222 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.
flyai search-hotel --dest-name "Hangzhou" --key-words "宠物友好" --sort rate_desc --check-in-date 2026-05-01 --check-out-date 2026-05-02

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The example hard-codes the hotel type as 民宿, introducing a specific language/locale choice in the skill content. There is no indication that the user opted into Chinese-language terms or that the locale constraint is intentional and justified for a region-specific workflow.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The runbook explicitly defines an internal execution log that captures the raw user query, which can include personal, financial, or travel-related data. Because the log is not shown to users and no notice, minimization, or retention controls are described, this creates a privacy and data-handling risk if sensitive input is stored unnecessarily.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Taken together, the schema stores raw user input and the persistence section appends the generated log to a local file, creating a concrete path for sensitive user data to be retained. In a travel-booking skill, user queries may contain names, destinations, dates, visa details, insurance needs, or other personal information, so persistent raw logging materially increases privacy and compliance risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The runbook instructs the agent to append execution logs to a local file when filesystem writes are available, but provides no safeguards around encryption, permissions, rotation, or user consent. Persisting interaction data to disk increases exposure because sensitive travel requests and derived metadata may remain accessible long after the session ends.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The fallback instructs a global npm install (npm i -g) directly in skill content without warning that it modifies the host environment and requires elevated trust in package supply chain and local PATH changes. In an agent-skill context, encouraging environment modification as part of normal operation increases risk because users or agents may execute it reflexively, and the surrounding 'Do NOT answer with training data' language makes the instruction more operationally forceful.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The file defines invocation triggers partly in Chinese (for example, '可以带狗' and '带宠物住有公园') and hard-codes Chinese search keywords, but it does not state that the skill is Chinese-only or give users a language choice. This can violate language/locale policy guidance when a skill implicitly requires a specific language without opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.