Security audit

Pool Hotel

Security checks for vulnerabilities and agentic risk

Overview

The skill can help search pool hotels, but it mandates risky host changes, forced booking links, shell-style user input handling, and hidden local logging.

Review before installing. This skill should only be used if you are comfortable installing and running the flyai CLI, sending travel searches to that third-party service, seeing booking links selected by that service, and accepting local logging risks. Prefer a version-pinned, user-approved, locally sandboxed CLI install with link validation and logging disabled or redacted.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:10
Finding: Forced Third-Party Booking Links and Promotional Output
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:65
Finding: Automatic Installation of an Unpinned Global npm Package
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:85
Finding: Shell Command Injection Through User-Controlled Command Placeholders
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/runbook.md:8
Finding: Persistent Storage and Unsafe Shell Logging of Raw User Queries
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook stores the complete raw user query and full generated commands in a hidden local file. Travel queries can reveal destinations, dates, budgets, accommodation preferences, and other personal information. No consent process, minimization requirement, redaction policy, retention period, access-control requirement, or deletion procedure is defined. The documented persistence mechanism also embeds generated JSON inside a single-quoted shell command. If any logged user-controlled content contains a single quote, it can terminate the shell string. Additional shell syntax can then be interpreted as a command. The use of `echo` also does not safely serialize arbitrary JSON content and can produce malformed log entries. ## ...[truncated 1386 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.
flyai search-hotel --dest-name "Sanya" --key-words "泳池" --sort rate_desc --check-in-date 2026-07-01 --check-out-date 2026-07-03

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly instructs the agent to execute external CLI commands and, if missing, perform a global npm install without any user confirmation, trust validation, or warning about the risks of installing and running third-party code. In an agent context, this can lead to arbitrary code execution from the package install step and unexpected system modification on the host running the agent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The runbook explicitly logs raw user input and full CLI commands in an internal execution log, which can capture sensitive personal, travel, account, or payment-adjacent data without any notice, minimization, or redaction. Because this skill handles travel workflows, user queries may include names, dates, locations, passport/visa details, or booking information, increasing privacy and compliance risk if logs are exposed or reused.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The runbook instructs appending execution logs to a local file, creating persistent storage of interaction data that may include raw queries, commands, and operational metadata. Persistent plaintext logging materially increases the blast radius of any local compromise, accidental inclusion in artifacts, or later access by other processes, especially in a consumer travel skill where user submissions may contain sensitive itinerary or identity-related details.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The fallback command hard-codes the hotel type as "民宿", which imposes a specific language/locale choice in the skill content. There is no indication that the user opted into Chinese-language terms or that this locale constraint is documented as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The playbooks hard-code Chinese search terms such as "泳池", "无边泳池", and "室内泳池" in command examples, while the surrounding document is otherwise bilingual/English-facing. This can impose a specific language behavior without stating that the skill is intended only for Chinese-language hotel inventory or offering a user language choice.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.