Security audit

Visa Check

Security checks for vulnerabilities and agentic risk

Overview

This skill is a travel/visa helper, but it automatically changes the user's environment, forces a commercial CLI and booking-link workflow, and persists raw travel queries without clear user control.

Review before installing. This skill can install a global npm package, route visa questions through a specific commercial travel CLI, include booking links by default, and write raw user queries to a local log. Do not use it for sensitive passport, immigration, or itinerary details unless those behaviors are acceptable and controlled.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:8
Finding: Mandatory Commercial Output and Agent Behavior Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:36
Finding: Automatic Installation of an Unpinned Global npm Dependency
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/runbook.md:34
Finding: Shell Command Injection and Undisclosed Persistence of Raw User Queries
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The logging mechanism constructs a shell command by placing generated JSON inside a single-quoted shell argument. The JSON includes the user's raw query and potentially generated command strings. A single quote in attacker-controlled input can terminate the intended shell string. Additional shell syntax can then be interpreted as commands by the shell. JSON escaping does not provide shell escaping, so producing valid JSON is insufficient to make this construction safe. For example, input structurally resembling the following can break the quoting boundary: ```text ' ; attacker_command ; # ``` The exact payload required depends on how ...[truncated 2054 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (11)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.
flyai keyword-search --query "日本签证要求"

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to install a global npm package if the CLI is missing, but provides no warning that this modifies the host system or requires user consent. In an agent context, this can lead to unapproved package installation, supply-chain exposure, and persistence on the user's environment beyond the immediate task.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The prerequisites section documents a global npm install without warning about system-wide modification, trust implications, or the need for user authorization. Because this is framed as a prerequisite for normal operation, compatible agents may treat it as routine and execute it automatically, increasing the risk of unauthorized environment changes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The fallback path tells the agent to install the CLI automatically when flyai is missing, then retry, with no consent gate or warning. This is especially dangerous in autonomous or semi-autonomous agent environments because a simple user travel query can trigger software installation and execution from an external registry.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: All playbooks hard-code Chinese search terms regardless of user language, locale, or destination context, which can bias retrieval toward a specific market and produce incomplete, mistranslated, or jurisdiction-misaligned visa information. In a visa-checking skill, this is especially dangerous because users may rely on inaccurate requirements, documentation lists, or processing expectations when making compliance-sensitive travel decisions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The transit visa trigger is underspecified because it omits a required destination parameter while the command template still interpolates {dest}. This can cause ambiguous execution, incorrect parameter binding, or fallback behavior that returns irrelevant or misleading visa guidance, which is risky in a travel-compliance workflow where users may act on inaccurate entry requirements.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The runbook directs the agent to retain raw user queries and detailed execution metadata, then persist them to disk, even though the skill’s stated purpose is visa and travel assistance rather than telemetry collection. Because visa/travel queries can contain passport, itinerary, nationality, employer, and other sensitive travel details, this creates unnecessary data retention and increases privacy, insider-access, and local-file exposure risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The schema explicitly stores raw user input in user_query without any notice, minimization, or limitation. In a visa/travel context, raw queries may include highly sensitive personal and trip information, so capturing them silently creates unnecessary privacy and compliance risk if logs are later accessed, reused, or breached.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The combination of storing raw user input in the execution schema and writing that schema to disk materially increases exposure of sensitive travel-related data. This is especially risky for a visa-check skill because users may supply personal identifiers, nationality, destination history, and supporting-document details that exceed what needs to be retained for normal operation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Appending execution logs to a local file creates a durable record of user interactions and operational details without any user-facing warning or stated security controls. Persistent local logs are easier to over-retain, improperly permission, or accidentally exfiltrate, especially when they include raw queries and detailed command history.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document says the execution log is not shown to users, yet separately requires risk_flags from that log to appear in user-facing output. This inconsistency can cause developers or operators to misunderstand what internal data may be surfaced, increasing the chance of accidental disclosure or unsafe handling of internal state.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.