Security audit

Road Trip

Security checks for vulnerabilities and agentic risk

Overview

This travel skill is mostly coherent, but it can auto-install a global third-party CLI and persist raw travel queries without clear consent or safeguards.

Install only if you are comfortable with the agent using FlyAI/Fliggy as the required data source, showing booking links, installing a global npm CLI, and writing local execution logs. Prefer requiring explicit approval before installation, pinning the CLI version, using a sandbox or project-local install, and disabling or redacting raw-query logs.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:8
Finding: Forced Commercial Output and Agent Behavior Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:119
Finding: Automatic Installation of an Unpinned Global npm Dependency
Content: View full analysis
Remediation: View remediation
`. 2. Verify package integrity using a lockfile and trusted integrity hashes. 3. Require explicit user approval before installing any third-party software. 4. Prefer a project-local, temporary, or sandboxed installation over `npm -g`. 5. Disable npm lifecycle scripts during installation when they are not required, such as with `--ignore-scripts`. 6. Review and constrain transitive dependencies before approving upgrades. 7. Document the expected registry and reject untrusted registry configuration. 8. Run the CLI with minimum filesystem, environment, and network permissions. 9. Avoid retaining the installed package across sessions unless persistence is explicitly required and approved. 10. Provide a safe failure mode when the dependency is unavailable rather than making installation mandatory. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: references/runbook.md:1
Finding: Persistent Logging of Raw User Queries Through Unsafe Shell Interpolation
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook directs the Agent to persist `{raw input}`, collected parameters, complete CLI command strings, fallback commands, and execution metadata. Travel requests commonly contain dates, precise origins and destinations, accommodation preferences, and potentially names or other personal itinerary information. No consent mechanism, redaction policy, retention limit, access-control requirem ...[truncated 2593 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 199)May include surrounding context.
flyai keyword-search --query "租车成都"

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly frames the agent as a CLI executor and later requires command execution, but it does not warn the user that following the workflow may run local commands and modify the host environment. In an agent setting, hidden command execution expectations can lead to unreviewed installation or execution on the user's machine, increasing supply-chain and system-integrity risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The prerequisites instruct a global npm installation of a third-party CLI without any caution about package trust, permissions, or system modification. Global installs can alter the environment, expose users to supply-chain compromise, and are especially risky when automated by an agent without clear consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 100% confidence
Finding: The mandatory environment check escalates from checking for a binary to automatically running npm i -g @fly-ai/flyai-cli if it is missing, with no user-facing warning or approval step. This creates a direct path for an agent to modify the host system and install external code, which magnifies supply-chain risk and makes the skill more dangerous than a passive documentation-only workflow.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The log template explicitly stores the raw user_query along with detailed execution metadata, and the runbook states this log is maintained internally without any user-facing notice. In a travel-planning skill, user queries may contain names, destinations, dates, booking details, or other sensitive travel information, so retaining this data creates unnecessary privacy and disclosure risk.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Taken together, the runbook requires persistent logging of raw user input plus internal execution details such as CLI commands, fallback behavior, and output metadata. This creates a natural-language data leakage path where sensitive user-provided travel details and operational internals may be exposed to anyone with log access, and the travel/booking context makes such data especially likely to be personal and valuable.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The runbook instructs appending execution logs to a local file, but gives no warning about local data storage, retention, encryption, or access restrictions. Because the same logs include request identifiers, raw queries, commands, and outcomes, file-based persistence increases the chance of unintended disclosure through local access, backups, debugging artifacts, or multi-tenant environments.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.