Security audit

Zoo Aquarium

Security checks for vulnerabilities and agentic risk

Overview

This skill provides travel search results, but it requires automatic global installation of an unpinned CLI and persists raw user queries in a local log.

Install only if you are comfortable with an external travel CLI being installed globally, used as the sole data source, and producing booking-link responses with flyai branding. Prefer manual installation of a pinned, reviewed CLI version in an isolated environment, and disable or remove the persistent raw-query execution log before use.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:9
Finding: Mandatory Commercial Output and Agent Behavior Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:57
Finding: Automatic Unpinned Global Installation of a Third-Party npm Package
Content: View full analysis
Remediation: View remediation
`. 4. Commit and verify a lockfile and package integrity metadata. 5. Verify registry provenance, publisher identity, signatures, and expected package checksums before execution. 6. Install the dependency locally in an isolated project, container, or restricted sandbox rather than with `npm -g`. 7. Run the CLI under a low-privilege account with restricted filesystem and network access. 8. Disable lifecycle scripts during installation where operationally possible, such as through `--ignore-scripts`, and separately audit any required installation scripts. 9. Maintain an allowlist of reviewed transitive dependencies and perform recurring supply-chain scans. 10. If the executable is unavailable, fail safely and provide manual setup guidance rather than modifying the host automatically. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: references/runbook.md:7
Finding: Shell Command Injection and Sensitive Query Retention in Execution Logging
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The logging schema explicitly includes the user's raw input. The generated JSON is then interpolated into a single-quoted shell command: ```bash echo '{generation_log_json}' >> .flyai-execution-log.json ``` Shell single quotes cannot contain an unescaped single quote. If raw user input is serialized into `generation_log_json` and contains a single quote, that character can terminate the quoted argument. Shell metacharacters that follow can then be interpreted as commands. JSON escaping does not inherently make data safe for shell interpolation because JSON escaping and shell escaping are separate contexts. For example, a raw query containing a payload shaped like the following could break out of the shell quoting ...[truncated 1988 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.
flyai search-poi --city-name "Chengdu" --category "动物园"

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The playbook hard-codes the search category as the Chinese term "动物园", which imposes a specific language/locale behavior. The file does not offer a language choice or explain why a Chinese-only query is required for this skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The playbook hard-codes the search category as the Chinese term "海洋馆", which imposes a specific language/locale behavior. The file does not offer a language choice or explain why a Chinese-only query is required for this skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The playbook hard-codes the search keyword as the Chinese term "野生动物园", which imposes a specific language/locale behavior. The file does not offer a language choice or explain why a Chinese-only query is required for this skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The runbook explicitly defines an internal execution log that captures user_query as raw input and states it is not shown to users. Storing raw user input without disclosure or minimization creates a privacy risk because queries may contain personal, travel, financial, or other sensitive data, and users are given no notice that their inputs are being retained internally.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The schema explicitly instructs retention of user_query as {raw input} in an execution log, which is a direct data-retention issue. In this skill context, users may submit travel plans, locations, booking details, visa questions, and potentially passport or insurance-related information, making raw-input retention more sensitive than in a low-risk informational skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The runbook instructs the agent to append execution logs to a local filesystem file, which can persist sensitive interaction data beyond the session. Because the same log schema includes raw user input and command history, local persistence increases the risk of unauthorized access, accidental exposure, or collection of sensitive data without user awareness.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.