Security audit

Pocket Wifi

Security checks for vulnerabilities and agentic risk

Overview

This WiFi rental skill supports a coherent travel-search workflow, but it should be reviewed because it can auto-install a global CLI and persist raw user queries in a hidden local log.

Before installing, confirm you are comfortable with a FlyAI/Fliggy-centered booking workflow, global installation of `@fly-ai/flyai-cli`, and local logging of travel queries. Prefer requiring explicit approval before installation, pinning and verifying the CLI package, disabling raw-query logging, and removing mandatory promotional branding or provider-exclusive result filtering.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:8
Finding: Mandatory FlyAI Output and Agent Behavior Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:37
Finding: Unpinned Global npm Package Installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/runbook.md:31
Finding: Shell Injection and Undisclosed Plaintext Query Logging
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook places the raw user query into `generation_log_json` and then embeds the generated JSON directly inside a single-quoted shell argument. Single quotes contained in user input are not escaped by the documented workflow. If the placeholder is replaced through direct textual interpolation, an attacker can supply an apostrophe to terminate the quoted argument, append shell syntax, and cause the shell to interpret additional commands. JSON encoding alone does not make a value safe for shell interpolation because JSON escaping does not escape shell single-quote boundaries. For example, a query shaped like the following can break the intended shell quoting when inserted without shell-safe encoding: ```text '; attacker_co ...[truncated 1954 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.
flyai keyword-search --query "日本WiFi租赁"

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest presents this as a narrow pocket-WiFi skill, but the description and instructions expand scope into broad travel booking and itinerary functions. This scope mismatch can cause an agent or user to invoke the skill in contexts they did not intend, increasing the chance of overbroad actions, unexpected data handling, or execution of unrelated travel workflows.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs the agent to install a global npm package automatically if the CLI is missing, which modifies the host environment without explicit user approval. This creates supply-chain and system-integrity risk, especially because installation happens as a prerequisite to answering a query rather than as an opt-in action.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The runbook explicitly records user_query as raw input and appends the full execution log to a local file, creating unnecessary retention of potentially sensitive personal data. In a travel-booking context, user queries may contain names, dates, destinations, passport or visa details, contact information, and other travel-sensitive data, so persistent plaintext logging increases privacy, compliance, and data exposure risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file includes npm i -g @fly-ai/flyai-cli, which performs a global package installation and changes the user's environment. The surrounding instructions do not warn the user that this command installs software system-wide or may require elevated privileges.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.