T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:10- Finding
Forced Commercial Output and Agent Behavior Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
Week Trip
Security checks for vulnerabilities and agentic risk
Overview
This travel skill is purpose-aligned overall, but it requires a mutable global npm install and silently persists raw travel queries and command logs, so users should review it before installing.
Install only if you are comfortable with this skill routing travel planning through FlyAI/Fliggy, installing a global npm CLI, showing booking links and branding, and keeping local execution logs. Prefer a pinned, reviewed CLI version, explicit approval before installation or logging, and redacted or disabled logs.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Error
- Location
SKILL.md:111- Finding
Unpinned Global Installation of a Third-Party npm Package
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/runbook.md:5- Finding
Unsafe Plaintext Persistence of Raw User Queries and Commands
- Content
View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook directs the agent to retain the raw user query and every executed or recovery command. It then recommends appending the generated record to a hidden plaintext file named `.flyai-execution-log.json`. Travel requests and CLI arguments can contain dates, destinations, accommodation preferences, budgets, and other potentially sensitive behavioral information. The design provides no consent mechanism, data minimization, field redaction, file-permission requirement, retention period, rotation policy, encryption, or deletion procedure. The persisten ...[truncated 2557 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
Full orchestration example with 3 cities over 7 days
text ## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The trigger phrase "week in Japan" is broad natural language that can easily appear in ordinary user requests, making unintended invocation of this playbook likely. In a travel-booking skill that can orchestrate multiple commands across cities and transportation providers, ambiguous triggering can cause the agent to run the wrong workflow, leading to unnecessary booking/search actions, incorrect parameter mapping, or over-collection of user travel details.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger phrase "one week in Bangkok" is also close to normal conversational travel planning language, so routine user input could accidentally activate a specific playbook without clear user intent to invoke this automation path. Because this skill supports hotel, flight, and attraction workflows, accidental triggering could push the system into premature searches or transactional flows that do not match the user's actual request.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The runbook explicitly records the raw user query in an internal execution log, which can capture sensitive travel data such as names, destinations, dates, booking intents, visa details, or other personal information. Storing this data without notice, minimization, or retention controls increases privacy and compliance risk if logs are accessed, retained too long, or exfiltrated.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The runbook instructs the agent to append execution logs to a local file, creating persistent storage of potentially sensitive operational and user data. Persistent local logging without disclosure, encryption, access controls, or retention policy raises the chance of unauthorized access, data leakage across sessions, and accidental inclusion in backups or source control.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Line L03 says outputs should follow the user's language, including Chinese when the user writes Chinese. However, the main output template at L22-L35 uses fixed English labels such as 'Price', 'Book', 'Tip', and 'Powered by', which contradicts that documented intent rather than merely omitting localization details.
- Content
Static analysis
No suspicious patterns detected.