T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:8- Finding
Mandatory Vendor-Specific Output and Agent Role Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
Rafting Spots
Security checks for vulnerabilities and agentic risk
Overview
The skill has a real travel-search purpose, but it requires an unpinned global CLI install and quietly keeps raw user-query logs, so it needs Review before installation.
Install only if you are comfortable with all results being routed through flyai/Fliggy, with commercial booking links in the output, and with a global npm CLI being installed. Prefer manual review and pinned or isolated installation of the CLI, and disable or remove the execution log unless you have a clear retention and privacy policy.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Error
- Location
SKILL.md:56- Finding
Unpinned Global Installation of an Unreviewed Third-Party npm Package
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/runbook.md:3- Finding
Undisclosed Persistence of Raw User Queries and Unsafe Shell-Based Log Construction
- Content
View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook directs the agent to retain the user's raw query in a local file while explicitly stating that the internal log is not shown to users. No consent, redaction policy, retention period, file permission requirement, or deletion procedure is specified. Travel queries can contain sensitive information such as destinations, dates, family composition, location, accessibility requirements, or other personal preferences. Persisting the complete raw input and command histor ...[truncated 2728 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
flyai search-poi --city-name "Zhangjiajie" --category "漂流"
text ## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill mandates installing a global npm package if the CLI is missing, but does not warn that this modifies the local system and introduces supply-chain risk. In an agent context, pushing automatic global installation can lead to unreviewed code execution and persistent environment changes on the host.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The activation trigger includes broad terms like "river" and "rapids," which can match many unrelated travel or geography queries and cause the skill to activate outside its intended rafting scope. Over-broad activation increases the chance the agent follows this skill's command-execution workflow unnecessarily, including package installation and external CLI use.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The prerequisites section directly instructs a global install of
@fly-ai/flyai-cliwithout any warning, consent gate, or trust guidance. This is dangerous because a skill file is untrusted input, and embedding install commands creates a path for agents or users to execute third-party code with broad local impact.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The runbook explicitly stores the user's raw input in an internal execution log, but there is no indication of minimization, redaction, consent, or retention controls. In a travel-booking skill, user queries may naturally contain personal data such as names, dates, destinations, passport or visa details, making silent collection of raw input a meaningful privacy and data-exposure risk.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Taken together, the schema and persistence section create a clear data-retention path for raw natural-language user input and detailed execution metadata. Because this skill covers travel, booking, visa, insurance, and itinerary workflows, stored free-text may include highly sensitive personal and financial context, making leakage or over-retention more dangerous than in a low-sensitivity domain.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file instructs the agent to append execution data to a local JSON log without any safeguards around permissions, encryption, rotation, or user notice. Persisting operational logs to disk increases the chance that sensitive travel-related inputs and booking metadata can be recovered by other processes, operators, or from backups after the original session ends.
- Content
Static analysis
No suspicious patterns detected.