Security audit

Quick Getaway

Security checks for vulnerabilities and agentic risk

Overview

This travel skill is coherent, but it requires a global third-party CLI install and silently stores raw travel-query logs, so it should be reviewed before use.

Install only if you are comfortable with a Fliggy/flyai-centered travel workflow, global npm package installation, and local diagnostic logging. Prefer using it in a contained environment, review the npm package/version first, and avoid entering sensitive personal travel details unless logging is disabled or controlled.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:10
Finding: Mandatory third-party service use and promotional output hijack the agent's behavior
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:40
Finding: Mandatory unpinned global npm package installation creates a supply-chain execution risk
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/runbook.md:3
Finding: Raw query logging uses unsafe shell interpolation and may persist sensitive data
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook directs the agent to record raw user input and complete CLI commands, then append generated JSON through a shell command. This creates two related weaknesses. First, raw travel requests and command arguments may contain personal or sensitive information, including travel dates, origin and destination details, accommodation preferences, names, or other contextual data. The file is written without consent, redaction, documented retention limits, encryption, or explicit restrictive permiss ...[truncated 2020 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.
flyai search-flight --origin "Beijing" --destination "Shanghai" --dep-date 2026-05-01 --back-date 2026-05-03 --sort-type 3

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly instructs the agent to act as a CLI executor and later mandates installing and running a third-party global package. This creates a supply-chain and system-modification risk because it normalizes executing external commands and altering the host environment without an explicit user consent or safety gate.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The prerequisite block tells the agent to run a global npm install command without any warning about persistent system changes, package provenance, or execution risk. A compromised or typo-squatted package could execute arbitrary install scripts and affect the user's machine or environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The workflow makes environment checking and package installation mandatory, then instructs the agent to continue operational behavior based on shell command results. This is more dangerous than a passive example because it operationalizes command execution as part of normal handling, increasing the chance of unauthorized system changes or execution of untrusted code.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The runbook explicitly records raw user input and detailed CLI activity in an internal execution log without any notice, minimization, or retention controls. In a travel-booking skill, user queries may contain names, dates, destinations, passport/visa details, and other sensitive trip data, so persistent internal logging increases privacy exposure and breach impact.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Storing raw natural-language user input and then persisting it to disk creates a direct data retention and leakage risk, especially because free-text travel requests often include incidental secrets or personal information not needed for long-term storage. Combined with command logging and fallback history, the log can reveal both sensitive content and operational behavior useful to an attacker or insider.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The runbook directs appending execution logs to a local file, which creates at-rest copies of request data and operational metadata without informing users. Local log files are commonly over-retained, broadly readable, backed up, or exfiltrated during host compromise, making otherwise transient travel-related data persist longer than necessary.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The trigger "3 days in {city}" is clearer than everyday speech, but the file does not explain whether close variants also invoke the playbook or how to distinguish it from other trip-planning intents. Because there are no negative examples or explicit scope rules, activation behavior remains somewhat ambiguous.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger "3 days 2 cities" is very short and ambiguous about what wording variants are accepted, when this playbook should be chosen over the single-city version, and whether additional context is required. The document provides no exclusion conditions or negative examples to disambiguate activation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.