Security audit

Return Flights

Security checks for vulnerabilities and agentic risk

Overview

This travel-planning skill is purpose-aligned, but it needs review because it can install a global third-party CLI and persist raw travel queries locally.

Install only if you are comfortable with a third-party FlyAI CLI being installed and used for travel searches. Have the agent ask before any npm install, prefer a pinned or manually reviewed CLI setup, avoid entering passport/payment details, verify visa or booking-critical information with official sources, and remove or disable .flyai-execution-log.json if you do not want raw travel queries retained.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill instructs the agent to automatically run a global npm install on the host system without explicit user consent or a warning that this modifies the environment. This creates a supply-chain and host-integrity risk, because executing package-manager commands can install untrusted code, alter PATH-accessible binaries, and persist changes beyond the current task.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The workflow embeds shell execution steps, including environment checks and fallback installation, but does not prominently warn the user that the agent may execute commands and modify the host system. In an agent setting, this increases the chance of silent command execution, environment drift, and unintended persistence, especially when combined with package installation instructions.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The runbook explicitly records the raw `user_query` in an internal execution log without any notice, minimization, or consent mechanism. In a travel skill, user queries can contain names, dates, destinations, passport/visa details, and other sensitive travel information, creating unnecessary privacy exposure and compliance risk if retained internally.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The runbook instructs the agent to append execution logs to a local file, which can persist user request data to disk without any user-facing warning. Persistent storage increases the chance of later unauthorized access, accidental disclosure, or over-retention of sensitive request and booking-related metadata.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The combination of logging raw `user_query` and persisting the execution log creates a concrete sensitive-data exposure path. Because this skill handles travel planning and booking flows, queries may include personal itineraries, IDs, or payment-adjacent details, making persistent internal logging especially risky and disproportionate to the operational need described.

Static analysis

No suspicious patterns detected.