must-play-recommendations

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:32 AM UTC
• Version: 1.0.1

Overview

This travel recommendation skill is not clearly malicious, but it asks users to rely on a broad third-party CLI with under-scoped commands, remote booking links, and an unpinned global install.

Review this skill before installing. Use it only if you trust the FlyAI CLI and are comfortable with network travel searches and external booking links. Prefer a pinned/local CLI install, avoid storing an API key unless needed, validate or inspect booking URLs before clicking, and keep the agent limited to attraction-related FlyAI commands.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:132

Finding

Mandatory FlyAI Branding and Commercial Link Injection

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 132-180
Vulnerability Type: Persistent modification of agent responses through mandatory branding and externally supplied commercial links
Risk Level: Medium

Vulnerable Code Snippet

markdown

> Based on fly.ai real-time results | Generated at: {timestamp}

[Click to book]({jumpUrl})

---

> Based on fly.ai real-time results | Generated at: {timestamp}

The supporting FlyAI documentation reinforces this requirement at flyai-readme.md:843-874:

markdown

[Click to book]({jumpUrl})

- Include the brand statement: "Based on fly.ai real-time results"

Technical Analysis

The skill requires the agent to insert FlyAI attribution and booking links into its final response. The booking URL is obtained from remote FlyAI results through the jumpUrl field and is placed directly into Markdown without URL validation, domain restrictions, or disclosure that it is a commercial redirection.

This behavior changes the agent's ordinary recommendation output into persistent brand promotion and a commercial traffic-redirection channel. Because the destination is supplied by an external service at runtime, the reviewed skill package does not fully determine where users will be sent.

The issue is classified as instruction hijacking because these output requirements are loaded as mandatory skill instructions and alter how the agent responds during the active session.

Attack Path

1. A user asks the agent for attraction recommendations.
2. The skill instructs the agent to query the FlyAI CLI.
3. FlyAI returns attraction data containing a jumpUrl.
4. The agent places the externally supplied URL directly into a trusted-looking booking link.
5. The skill also requires FlyAI branding in the response, including a repeated footer.
6. If the upstream response is compromised or contains an unexpected destination, the user may be redirected to ...[truncated 635 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove mandatory brand placement from the skill's response template.
2. Include attribution only when it is relevant and clearly identify it as an external data source.
3. Do not automatically insert commercial links unless the user requests booking options or explicitly consents to receiving them.
4. Validate every returned URL before rendering it:
   • Require HTTPS.
   • Reject credentials, fragments containing executable content, and malformed URLs.
   • Restrict destinations to a documented allowlist of approved domains.
   • Resolve and validate redirects before presenting a link when practical.
5. Label commercial links clearly, such as “External commercial booking link.”
6. Treat all fields returned by FlyAI as untrusted remote data and escape them before inclusion in Markdown.
7. Provide a non-commercial recommendation mode that omits booking links and promotional branding.

T08 · Insecure Dependencies

Warning

• Location: flyai-readme.md:28

Finding

Unpinned Global Installation of a Third-Party CLI Package

Content

View full analysis

Vulnerability Details

File Location: flyai-readme.md, line 28
Vulnerability Type: Unpinned global npm dependency installation
Risk Level: Medium

Vulnerable Code Snippet

bash

npm install -g @fly-ai/flyai-cli

Technical Analysis

The installation command retrieves the current package version from npm and installs it globally. No exact version, lockfile, integrity hash, provenance check, or lifecycle-script restriction is specified.

npm packages may execute lifecycle scripts during installation. A mutable latest release, compromised publisher account, registry compromise, or malicious transitive dependency could therefore introduce code that was not present during this audit. Global installation also increases the affected scope by modifying the user's shared command environment.

The package name does not appear to be a typographical imitation based on the available project files. The confirmed weakness is the unsafe and non-reproducible installation method, not a confirmed compromise of the referenced package.

Attack Path

1. A user follows the documented setup procedure.
2. npm resolves the package to the current registry release rather than an audited exact version.
3. npm downloads the package and its dependency graph.
4. Any package lifecycle scripts execute with the privileges of the installing user.
5. A compromised release or dependency can modify user-accessible files, steal accessible credentials, or replace the globally available flyai command.
6. Subsequent skill invocations execute the compromised CLI.

Impact Assessment

Code obtained through npm can execute with the privileges of the account performing the installation. If the installation is run with elevated privileges, the impact may extend to system-wide files and commands.

Potential impact includes:

• Arbitrary code execution as the installing user.
• Access to files, environment variables, and credent ...[truncated 223 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to a reviewed exact version rather than relying on the current registry release.
2. Prefer a project-local development dependency managed by a committed lockfile instead of a global installation.
3. Verify npm package provenance and published integrity metadata before installation.
4. Review the package and its transitive dependencies for lifecycle scripts.
5. Where lifecycle scripts are unnecessary, install with scripts disabled and document any resulting limitations.
6. Run the CLI in a restricted environment with minimal filesystem, network, and credential access.
7. Do not instruct users to run the installation with administrative privileges.
8. Establish a controlled update process in which new versions are reviewed before the pinned version is changed.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:53

Finding

Potential Shell Command Injection Through Unvalidated City Input

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 53-65
Vulnerability Type: User-controlled input interpolated into shell command templates
Risk Level: High

Vulnerable Code Snippet

bash

flyai search-poi --city-name "{city-name}" --poi-level 5

bash

flyai ai-search --query "{city-name} attraction recommendations"

The same interpolation pattern is repeated for the fallback search at SKILL.md:91:

bash

flyai search-poi --city-name "{city-name}" --poi-level 4

Technical Analysis

The city name is extracted from user input and inserted into shell command templates. The skill mentions checking whether a city is valid, but it does not define an enforceable allowlist, escaping algorithm, maximum length, or a shell-free invocation method.

Double quotes do not provide complete protection if untrusted input is inserted into a shell command. Depending on how the agent performs substitution, input containing a closing quote, command substitution, backticks, variable expansion, or shell control operators may escape the intended argument context.

The vulnerability becomes exploitable when an implementation constructs a command string from these templates and passes it to a shell. It can be prevented by invoking the CLI through an argument-array API without shell interpretation.

Attack Path

1. An attacker submits a crafted value while presenting it as a city name.
2. The agent extracts the supplied text as the city parameter.
3. The value is substituted into one of the documented command templates.
4. The resulting string is executed through a shell.
5. Shell syntax embedded in the value terminates or modifies the intended argument.
6. The injected command executes with the privileges and environment of the agent process.

Exploitability depends on the execution layer using shell-string interpolation. The project does not include executable source code demonstrating ...[truncated 854 chars]

Remediation

View remediation

Remediation Suggestions

1. Never concatenate the city name into a shell command string.
2. Invoke the CLI with a process API that accepts an executable and a separate argument array, for example:

   text

   executable: flyai
   arguments: ["search-poi", "--city-name", validatedCity, "--poi-level", "5"]
   shell: false
   

3. Validate the city against a maintained allowlist or authoritative city identifier list.
4. If broader names must be accepted, enforce:
   • A conservative Unicode letter and spacing policy.
   • A strict maximum length.
   • Rejection of quotation marks, control characters, newlines, substitutions, and shell metacharacters.
5. Keep shell execution disabled even after validation; validation must not replace safe process invocation.
6. Apply the same controls to search-poi, ai-search, and fallback 4A queries.
7. Add automated tests using hostile input containing quotes, newlines, command substitutions, backticks, redirection operators, and command separators.
8. Run the CLI with minimal filesystem, credential, and network privileges to reduce impact if another injection flaw is introduced.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger phrases are broad, generic travel expressions like '有什么好玩' and '去哪玩' that commonly appear in everyday conversation. This can cause the skill to activate unintentionally for loosely related queries, increasing the chance of context hijacking, incorrect tool use, or the skill overriding a more appropriate agent behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest description is written as a fixed Chinese-language interaction contract for recommending attractions, but nowhere indicates that users may choose another language or that the skill is intentionally limited to a China-only or Chinese-only deployment context. Under the policy, a locale or language constraint should be opt-in or clearly justified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger set includes broad phrases like '玩什么', '去哪玩', and '旅游推荐', which can match ordinary conversation and cause the skill to activate unexpectedly. Over-broad activation can route unrelated user input into this skill, leading to unintended tool use, poor isolation between skills, and possible disclosure of external content or links when the user did not request this behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The README documents a general-purpose travel CLI with flights, hotels, trains, and packages, which materially exceeds the skill's declared purpose of recommending must-play attractions. This scope mismatch increases the chance that an agent invoking the skill could be steered into collecting extra user data or performing broader travel-planning actions than users expect, weakening least-privilege boundaries.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The command overview prominently exposes transportation, lodging, and package-booking capabilities that are unnecessary for a scenic-spot recommendation skill. In an agent setting, this creates permission creep: the skill can be repurposed for booking-adjacent or itinerary functions outside user expectations, increasing data exposure and the blast radius of misuse.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger set includes very generic travel phrases such as '玩什么' and '去哪玩', which can match broad, ordinary conversation and cause the skill to activate outside a narrowly intended context. Over-broad activation can lead to inappropriate tool use, accidental data-source queries, and reduced user control over when the skill is invoked.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The natural-language documentation and examples are entirely Chinese, which effectively fixes the skill’s language/locale without stating that this is a China-specific or Chinese-only skill. There is no user opt-in or documented justification for the language constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

SQP-3 applies to all file types and includes language or locale policy violations. The file forces a single language for all instructions and outputs without any opt-in, alternative locale, or justification that the tool is region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This is a markdown file, so SQP-2 applies to omitted warnings about behaviors affecting user data or privacy. The documentation tells users to run flyai config set FLYAI_API_KEY "your-key" but gives no disclosure about where the credential is stored, whether it is persisted locally, or how to remove it later.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The best-practices section recommends chaining hotel search with attraction search, effectively expanding this skill from POI recommendation into itinerary and accommodation planning. While not directly code execution, this guidance normalizes broader actions than the declared scope and can cause the agent to solicit or process additional travel details unnecessarily.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

All trigger phrases, the input description, and the examples are Chinese-only, which implies a fixed language/locale expectation. There is no indication that users can opt into another language or that the locale restriction is explicitly justified as a region-specific skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.