Security audit

Private Car

Security checks for vulnerabilities and agentic risk

Overview

This travel skill is mostly coherent, but it should be reviewed because it mandates an unpinned global CLI install and can persist raw travel queries in a local log.

Review before installing. Only use this skill if you are comfortable with FlyAI/Fliggy being the exclusive provider, with booking links and branding in results, and with a global npm CLI install. Avoid entering sensitive personal itinerary details unless logging is disabled or sanitized, and prefer manually installing a pinned, reviewed CLI version in an isolated environment.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:10
Finding: Forced Commercial CLI and Output Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:35
Finding: Unpinned Global Installation of a Third-Party npm Package
Content: View full analysis
Remediation: View remediation
`. 4. Use a lockfile and verify npm integrity metadata or a separately distributed cryptographic checksum. 5. Verify package ownership, provenance, registry source, and signatures where supported. 6. Prefer an isolated project-local installation, container, or sandbox instead of `npm i -g`. 7. Disable lifecycle scripts during installation where compatible, such as with `--ignore-scripts`, and separately review any required setup. 8. Run the CLI with minimal filesystem, environment, credential, and network permissions. 9. Define an update-review process so a new package version cannot be used until it has been audited. 10. If the dependency is unavailable, fail safely and provide manual setup instructions rather than installing it automatically. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: references/runbook.md:7
Finding: Plaintext Persistence of Raw User Queries and Execution Metadata
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook directs the agent to capture the complete raw user query and command details, then optionally append the generated record to a plaintext file. Travel queries may contain names, dates, locations, accommodation details, accessibility requirements, or other personal information. No consent requirement, field-level redaction, retention period, access-control mode, encryption mechanism, secure log directory, size limit, or deletion procedure is defined. The relative filename also places the log in the current working directory, where it may be included in archives, source ...[truncated 1800 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.
flyai keyword-search --query "包车一日游杭州"

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly directs the agent to install a third-party CLI globally via npm if it is missing, which modifies the host environment and executes untrusted package code without prior user approval. In an agent setting, this creates a supply-chain and system-integrity risk because package install scripts may run automatically and the global install changes persist beyond the task.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The prerequisites section instructs use of a global npm install without warning that it will alter the system and execute code from a third-party package source. Even though presented as setup documentation, agent frameworks may treat such instructions operationally, leading to unauthorized environment changes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The environment check workflow goes beyond documentation and tells the agent to detect a missing binary, install a third-party CLI, and then execute it automatically. This is more dangerous because it combines autonomous package installation with immediate execution, increasing exposure to malicious packages, install hooks, and unintended system changes without user awareness.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The runbook explicitly records raw user queries and detailed command execution data in an internal log while stating the log is not shown to users. This creates a privacy and data-handling risk because travel-related queries may contain sensitive personal, itinerary, or booking information, and users are given no notice, minimization, or retention controls.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The runbook directs retention of raw user input in an internal execution log and pairs it with step-by-step operational details, creating a consolidated record of potentially sensitive travel requests and system actions. In this skill context, users may provide names, destinations, dates, visa details, booking preferences, or other personal travel data, making persistent storage more dangerous than in a low-sensitivity domain.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The append operation persists execution logs to a local file without any safeguards around sensitive contents, file permissions, rotation, or retention. If the log contains raw queries, commands, booking details, or recovery actions, local persistence increases exposure to unauthorized access, accidental disclosure, and long-term retention of personal data.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.