Security audit

Road Trip

Security checks for vulnerabilities and agentic risk

Overview

This road-trip skill is travel-related, but it asks the agent to install an unpinned global CLI and quietly persist raw trip queries in a local log.

Install only if you trust the Flyai CLI and are comfortable with a global npm package being installed and run for travel searches. Treat trip details as potentially logged locally; avoid entering sensitive personal or payment information, and delete or disable `.flyai-execution-log.json` logging if you use the skill.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill is named and marketed as a road-trip planner, but its description expands into broad flight, hotel, train, visa, and insurance booking. This scope mismatch can cause unintended activation and over-broad tool use, increasing the chance an agent invokes travel-booking capabilities outside the user's intended self-driving scenario.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The documented command set centers on generic travel search operations such as flights, hotels, and POIs rather than a constrained road-trip workflow. In practice, this broadens the executable surface area and allows the skill to collect or act on travel intents unrelated to its declared purpose, which is a form of capability overreach.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The skill explicitly says it should not activate for non-driving trips, yet it embeds non-driving travel-booking commands and workflows elsewhere in the file. This contradiction weakens policy enforcement and makes it easier for an agent to justify inappropriate execution paths despite the stated restriction.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: The playbook hardcodes a Chinese-language search query (`租车 {city}`) rather than deriving query language from the user's language or obtaining consent. This can override user intent, cause unexpected cross-locale searches, and expose users to mismatched regional results or data handling contexts they did not choose.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The runbook explicitly records `user_query` as raw input in an internal execution log, which can capture sensitive travel details, identifiers, payment-related text, or other personal data without any stated minimization, consent, retention, or redaction controls. In a travel-booking skill, users commonly provide highly sensitive itinerary and personal information, so persistent raw-query logging materially increases privacy and compliance risk if logs are accessed, leaked, or reused.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The runbook instructs appending execution logs to `.flyai-execution-log.json` on the local filesystem, creating persistent storage of potentially sensitive operational and user-derived data without safeguards. Because the same runbook also logs raw queries and command history, filesystem persistence increases exposure to unauthorized local access, accidental inclusion in backups/artifacts, and long-term retention beyond operational necessity.

Static analysis

No suspicious patterns detected.