Security audit

Trip Advisor

Security checks for vulnerabilities and agentic risk

Overview

This travel-planning skill has a coherent purpose, but it asks the agent to install and run an unpinned global CLI, execute user-filled shell command templates, and persist sensitive travel queries without clear user control.

Review before installing. Use only in a sandboxed environment, avoid sharing sensitive passport, identity, or private itinerary details, do not allow automatic global npm installation without verifying the package and version, and do not persist execution logs containing raw travel requests.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:10
Finding: Mandatory Agent Role Override and Commercial Output Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:127
Finding: Automatic Installation and Execution of an Unpinned Global npm Package
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:146
Finding: User-Controlled Values Are Interpolated into Shell Command Templates
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/runbook.md:7
Finding: Raw User Queries and Command Details Are Persisted in a Hidden Plaintext Log
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook directs the Agent to retain the complete raw user query, collected parameters, CLI commands, recovery commands, and operational metadata. Travel requests can reveal sensitive information such as travel dates, origin, destination, budget, interests, and itinerary. The data is appended to `.flyai-execution-log.json` without requirements for user consent, redaction, restrictive permissions, encryption, retention limits, secure deletion, or exclusion from source-control and backup systems. A leadi ...[truncated 1825 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 207)May include surrounding context.
flyai search-flight --origin "Shanghai" --destination "Tokyo" --dep-date 2026-05-01 --sort-type 3

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The 'When to Activate' section includes generic phrases like 'itinerary' and 'travel planning', which can overlap with common user requests and may cause unintended invocation. The exclusion 'specific type → see specialized planners' is also vague because it does not define which requests should not trigger this skill or provide concrete negative examples.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This playbook directs the agent to send user-provided destination, dates, and travel context to external CLI-backed travel services without any explicit user-facing disclosure or consent step. In a trip-planning skill, those details can reveal sensitive itinerary and travel patterns, so silent transmission creates a real privacy and data-handling risk even if the service use is functionally expected.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The Quick Plan workflow still transmits origin, destination, and date information to external services, but omits any warning or consent language. Because the playbook says to never answer without executing, it increases the chance that private travel details are automatically disclosed during routine use without informed user approval.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The Budget Plan sends not only itinerary data but also budget constraints such as maximum hotel price to external search services without warning. Budget information can be sensitive profiling data, and combining it with travel dates and destination increases privacy exposure and potential misuse if users are unaware their data is being transmitted.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The runbook explicitly records user_query as raw input in an internal execution log, but provides no notice, minimization, or retention controls. In a travel-planning skill, user queries commonly contain sensitive personal data such as destinations, dates, names, passport/visa details, budgets, or booking preferences, so storing them verbatim increases privacy and data exposure risk.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Taken together, the schema stores raw natural-language user input and then persists the full execution log to a local file, creating a clear data retention and leakage path. In this skill's travel context, free-text requests may include especially sensitive PII and travel metadata, making the combined design more dangerous than generic telemetry because it can expose identity, itinerary, and booking-related information in durable logs.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The runbook instructs appending execution logs to a local file without any user-facing disclosure or safeguards around access, encryption, or lifecycle management. Persistent local writes materially increase the chance that sensitive travel and booking data will remain on disk and be exposed to other processes, users, backups, or later compromise.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.