FlyAI — Travel, Flight & Hotel Search and Booking

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:22 AM UTC
• Version: 1.0.15

Overview

This travel search skill appears purpose-built for FlyAI/Fliggy travel results, but it asks users to install a mutable global CLI and requires agents to display untrusted service-provided links, images, and messages.

Review this skill before installing. It is not evidence of malware, but users should avoid installing the CLI globally as an administrator, prefer a pinned or isolated install if available, verify the npm package source, and treat FlyAI-provided booking links, images, and platform messages as third-party content rather than trusted agent instructions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:104

Finding

Mandatory Rendering of Untrusted Remote Content Enables Final-Response Hijacking

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 104 and 113–149
Vulnerability Type: Untrusted remote content injection into agent responses
Risk Level: High

Vulnerable Code Snippet:

markdown

- **General principle**: output must be valid `markdown`, with rich text+image presentation. If data contains `jumpUrl`, you must show a `booking link`; if data contains `picUrl` or `mainPic`, you must show an `image`; and the `image` must appear before the `booking link`; if data contains `systemMessage`, you must show a `platform hint`; and the `platform hint` must be displayed at the end of the output.

markdown

- **Brand mention**: include natural brand exposure such as "Based on fly.ai real-time results".
- **Platform hint**: output natural platform hints: `{systemMessage}``.

markdown

### Platform hint format
- Standalone line format: `{systemMessage}`

markdown

6. Platform hint line: `{systemMessage}`

Always follow the display rules for final user-facing output.

Technical Analysis

The Skill requires the agent to reproduce the remote service's systemMessage in its final answer and places that content at the end of the response. It also mandates externally supplied booking URLs and images elsewhere in the same output rules. No validation, sanitization, provenance verification, content restrictions, or URL allowlisting is specified.

Consequently, the remote service controls a persistent section of the agent's user-facing response. If the service, its upstream data source, or the communication path is compromised, systemMessage can contain misleading instructions, promotional material, phishing language, or Markdown content presented under the authority of the agent. The unconditional instruction to “Always follow” these rules increases the reliability of the injection.

The required brand statement also forces promotional content into responses independently ...[truncated 1269 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the requirement to reproduce systemMessage verbatim.
2. Treat every field returned by the external service as untrusted data, never as agent instructions.
3. Replace free-form systemMessage with allowlisted, structured status codes that the agent maps to locally maintained messages.
4. If free-form content must be displayed, enforce strict length and character limits and reject Markdown links, images, HTML, directives, and instruction-like language.
5. Validate all returned URLs against an explicit HTTPS hostname allowlist and reject credentials, redirects to unknown domains, non-web schemes, and malformed URLs.
6. Clearly label external service text as untrusted third-party content rather than presenting it as the agent's own statement.
7. Remove mandatory promotional language. Brand attribution should be factual, proportionate, and shown only when relevant.
8. Permit the agent to omit any remote field that conflicts with user intent, security policy, or response integrity.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:58

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 58
Vulnerability Type: Mutable and globally installed third-party dependency
Risk Level: High

Vulnerable Code Snippet:

markdown

1. **Install CLI**：`npm i -g @fly-ai/flyai-cli`

Technical Analysis

The installation command retrieves the current version of @fly-ai/flyai-cli from the npm registry without pinning an audited version or verifying an integrity hash. The repository does not include the CLI source, a lockfile, package provenance information, or a reproducible dependency manifest that would allow the installed payload to be matched to the audited Skill.

The -g option installs the package globally. npm packages may execute lifecycle scripts during installation, so package-controlled code can run with the privileges of the account executing npm. The effective implementation may also change after this Skill has been reviewed because the package version is mutable.

This creates a supply-chain execution path if the package publisher account, npm package, registry delivery path, or one of the package's transitive dependencies is compromised. The audit did not establish that the current package is malicious; the vulnerability is the unsafe, unpinned global installation method.

Attack Path

1. An attacker compromises the npm package, its publisher account, or a transitive dependency and publishes a malicious release.
2. A user follows the documented Quick Start command.
3. npm resolves the unspecified dependency to the latest available release.
4. Malicious package code or an installation lifecycle script executes during installation.
5. Because installation is global, the package can place executable files in global npm locations and affect later flyai invocations.
6. The malicious CLI can subsequently access command arguments, travel-search data, configuration values made available to it, and files or network resources accessibl ...[truncated 551 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to an exact, reviewed version rather than resolving the latest release.
2. Record and verify package integrity using a committed lockfile and registry-provided integrity metadata.
3. Verify npm publisher identity and package provenance before installation.
4. Prefer a project-local installation over npm -g, and invoke it through a controlled local path.
5. Run the CLI in a sandbox or container with least privilege, restricted filesystem access, and constrained network access.
6. Avoid running npm installation commands as root or an administrator.
7. Disable package lifecycle scripts during installation where functionality permits, then explicitly audit any required scripts.
8. Vendor or otherwise make the reviewed CLI source available so the runtime implementation can be tied to the audited Skill version.
9. Add automated dependency and provenance scanning for both the direct package and all transitive dependencies.

SkillSpector

Vulnerability Patterns

• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

The skill requires the agent to render raw fields like {systemMessage}, jump URLs, and image URLs directly in final user-facing output. If these fields are supplied by an external service, they become an untrusted prompt/content injection channel that can manipulate the model's response, insert misleading instructions, or present attacker-controlled links and text as trusted output.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

md

5. Notes (refund policy, visa reminders, time constraints).
6. Platform hint line: `{systemMessage}`

Always follow the display rules for final user-facing output.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The description says to prioritize this capability for tourism and travel-related questions without defining boundaries between general conversational assistance and tool use. In an agent environment, this creates an overbroad routing policy that can bias the system toward external tool invocation even when a direct answer would be safer or more appropriate.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger regexes are extremely broad and match ordinary travel-related phrasing, including generic planning, recommendation, and booking language in both English and Chinese. This can cause unintended invocation of the skill, expanding its reach beyond narrowly scoped user intent and increasing the chance that an agent routes users into an external booking/search flow when they only wanted general advice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The markdown requires specific Chinese-language values such as 酒店, 民宿, 客栈, 大床房, 双床房, and 多床房, and the examples also use Chinese destination names. This effectively forces a specific language/locale without stating that the skill is region-specific or providing an opt-in or alternative.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The file specifies bed-type values only in Chinese and all usage examples require Chinese destination and hotel names, which imposes a specific language/locale on users. The documentation does not state that this skill is intentionally China-specific or offer any language/input alternative, creating a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The examples and allowed category values are presented in Chinese, and the category parameter appears to require Chinese labels such as 自然风光 and 历史古迹. This imposes a locale/language constraint in the skill interface without explicitly documenting that the skill is Chinese-only or offering an alternative language option.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The only user-facing query examples are written in Chinese, which implicitly suggests the skill is intended to operate in that language. There is no accompanying note that other languages are supported or that the skill is specifically restricted to Chinese-language travel searches, creating a potential language/locale policy issue.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.