Security audit

Photo Spots

Security checks for vulnerabilities and agentic risk

Overview

This travel skill is not clearly malicious, but it asks the agent to install and run an unpinned third-party CLI, force booking links, and retain raw user queries in local logs without enough user control.

Review this before installing. Use it only if you are comfortable with flyai/Fliggy being the required travel data source, with booking links in results, and with installing a global npm CLI. Prefer a pinned, locally installed CLI, require approval before any install, disable or remove raw-query logging, and avoid passing untrusted user input through shell command strings.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:8
Finding: Forced Third-Party Tool Usage and Commercial Output Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:35
Finding: Automatic Installation of an Unpinned Global npm Package
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:67
Finding: Shell Command Injection Through Unescaped User-Derived Parameters
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/runbook.md:3
Finding: Undisclosed Persistent Logging of Raw User Queries with Unsafe Shell Serialization
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook instructs the agent to record the complete raw user query, CLI commands, operational status, and related metadata in `.flyai-execution-log.json`. The log is described as internal and “Not shown to users,” but no consent, notice, data minimization, retention period, file permissions, or redaction policy is provided. Raw travel queries may contain names, locations, itinerary details, dates, or other personal information. Persisting that content in a project file can expose it to later processes, repository operations, backups, or other users of the workspace. The persistence command introduces a separate command-injection risk. Generated JSON is inserted into a single-quoted shell argument: ```bash echo '{generation_log_json}' >> .flyai-execution-log.json ``` A single quote originating from the raw query or another generated field can terminate the shell string. Subsequent shell syntax in that field may then be interpreted as a command. JSON escaping does not provide shell escaping and cannot make this construction safe. ### Attack Path #### Confidentiality Path 1. A user submits a query containing sensitive itinerary or personal information. 2. The raw request is copied into the `user_query` field. 3 ...[truncated 1485 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.
flyai search-poi --city-name "Shanghai" --category "地标建筑"

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly instructs the agent to run flyai --version and, if missing, to globally install @fly-ai/flyai-cli via npm i -g before proceeding. That modifies the host environment and executes third-party code without requiring explicit user consent, sandboxing, or a trust verification step, creating supply-chain and arbitrary code execution risk on the agent machine.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The playbook hard-codes Chinese-language category values such as "地标建筑", "城市观光", and "文创街区" in its command examples. This imposes a specific language/locale behavior without offering user choice or explaining why a Chinese locale is required, which matches the stated natural-language policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The runbook explicitly logs user_query as raw input and defines persistent execution logging, which can capture sensitive personal, travel, financial, or identity-related information users may provide. Because this is an internal log not shown to users and there is no retention, minimization, or consent guidance, it creates a realistic privacy and data exposure risk if the file is accessed, backed up, or mishandled.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Taken together, the schema stores natural-language user_query content and the persistence section writes the generated log to .flyai-execution-log.json, creating a direct data retention path for potentially sensitive free-form user text. In a travel skill, users may include passport, visa, itinerary, hotel, payment-adjacent, or location details, so retaining raw queries materially increases privacy, compliance, and secondary disclosure risks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The runbook instructs the agent to append execution logs to a local file whenever filesystem writes are available, but provides no notice, controls, or safeguards around that persistence. Even if the contents are operational, silent local retention increases the chance that user-related data remains on disk longer than intended and is later exposed through host compromise, log collection, or accidental sharing.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.