Security audit

resort-hotel

Security checks across malware telemetry and agentic risk

Overview

This travel-booking skill is not clearly malicious, but it asks agents to install and run an unpinned global travel CLI automatically, which deserves user review before installation.

Install only if you are comfortable with an agent using an external travel CLI and sending travel-search details to that service. Prefer reviewing and installing the flyai CLI yourself in an isolated environment, with a pinned version, before enabling this skill.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The Domain Knowledge section maps user intent to `--seat-class-name`, but the skill earlier forbids any parameter not listed in the Parameters table. That contradiction encourages parameter invention and can lead the agent to execute undocumented behavior or fail in ways that are hard to audit.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The Domain Knowledge section maps user intent to `--seat-class-name`, but the skill earlier forbids any parameter not listed in the Parameters table. That contradiction encourages parameter invention and can lead the agent to execute undocumented behavior or fail in ways that are hard to audit.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The activation rules include broad phrases like 'find a hotel' and '订酒店', which overlap with generic travel and lodging requests far beyond resort-hotel flights. Overbroad triggering can cause the wrong skill to activate, leading users into unnecessary CLI execution, data collection, or bookings in contexts where a narrower skill should handle the request.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill directs the agent to install and run a global package (`npm i -g @fly-ai/flyai-cli`) if the CLI is missing, without requiring explicit user consent or presenting any warning. This is dangerous because it converts a simple travel query into silent software installation and code execution from an external registry, increasing supply-chain and system-integrity risk.

Ssd 4

Medium

Confidence: 96% confidence
Finding: The workflow normalizes a trust-establishing pattern: check for a tool, install it globally if absent, then immediately use it to satisfy the request. In an agent environment, this is especially risky because it trains the agent to fetch and execute fresh code before serving the user, creating a strong supply-chain attack surface and reducing meaningful user oversight.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.