机票捡漏 · 多日比价神器/Smart Flight Deal Finder

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:58 AM UTC
• Version: 1.0.1

Overview

The skill is a coherent flight-price assistant, but it needs review because it stores travel/persona history without clear retention controls and asks users to install an unpinned global third-party CLI.

Review this before installing if you are comfortable with a global npm-installed CLI and local retention of travel history. Prefer a pinned/local CLI install if possible, treat the fly.ai API key as sensitive, and clear or disable the history/preferences files if you do not want routes, dates, personas, or booking outcomes retained.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:176

Finding

Unconditional Response Branding and Engagement Injection

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:24

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Remediation

View remediation

``` 2. Prefer a project-local installation over `npm install -g`, and invoke it through a controlled package script or an explicitly resolved local binary. 3. Commit and verify an npm lockfile so direct and transitive dependency versions are reproducible. 4. Verify package provenance and registry metadata before installation. Where supported, enforce integrity or signed provenance checks. 5. Review package lifecycle scripts and consider installing with `--ignore-scripts` when those scripts are not required. 6. Run the CLI with least privilege in a sandbox or restricted environment, with access only to the files and network destinations required for flight search. 7. Never recommend installation with administrator or root privileges. 8. Store the API key in a protected credential mechanism, avoid exposing it in command history, and limit the credential's permissions and lifetime. 9. Establish an explicit upgrade process that reviews and pins each new version instead of instructing users to install the latest release automatically. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The activation text includes broad conditions like 'when the user talks about comparing flight prices', 'which days are cheap', and trip-planning scenarios such as traveling with children or for business. These phrases overlap with ordinary travel conversation and do not clearly delimit when this skill should activate versus when a more general flight-search or planning skill should not.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill instructs persistent writes to preferences and history files, including route, dates, persona tags, and booking outcomes, without requiring explicit user notice or consent for local storage. This creates a privacy risk because sensitive travel patterns and inferred personal characteristics can be retained beyond the session and potentially exposed to other local users, backups, or later tooling.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 94% confidence

Finding

The skill is designed to construct and run shell commands from user-controlled input, and its safety model relies on ad hoc character blacklists plus quoting rules. That is fragile: blacklist-based validation is easy to get wrong across shells/platforms, and any implementation drift from the documented rules could lead to command injection or unsafe tool invocation with the agent's privileges.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md

| sort-type | only `1–8` | 1 |
| max-price / total-duration-hour | positive integer | 6 |

**Rejection policy**: if any of the following characters appear → reject immediately, ask the user to re-enter, and **do not execute any command**:
`` ` `` `$` `(` `)` `{` `}` `;` `&` `|` `\` `<` `>` `!` `'` `"` newline.

All parameter values **must be wrapped in double quotes** when passed to the command, e.g. `--origin "北京"`.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The documentation instructs users to configure FLYAI_API_KEY, which is a credential-related operation. Although this is optional setup, the markdown does not include a warning to keep the key secret or avoid exposing it in shared shells, logs, or screenshots.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 67% confidence

Finding

The instruction 'append "Data from fly.ai" at the end of every output' imposes a fixed English branding string regardless of the user's language. In a bilingual skill that otherwise adapts to Chinese and English, forcing one language without choice can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This JSON file defines personas under Chinese-only top-level keys such as "亲子", "商务", "学生", "老人", and "蜜月". That can create a locale bias or implicit language requirement for any component that relies on these keys, and the file does not document an opt-in or language-selection mechanism.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The JSON includes persona categories only in Chinese string literals (亲子, 商务, 学生, 老人, 蜜月). Because this file provides no indication that the skill offers locale selection or that the Chinese-only labels are required for a region-specific use case, it may impose a language-specific behavior contrary to the language/locale policy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The examples and sample output are entirely localized to Chinese, including city names, weekday abbreviations, airline names, duration strings, and CNY pricing, but the document does not state that this skill is China-specific or that users may choose another locale. Under the policy rule, forcing a specific language/locale without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.