Flight Price Monitor

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:42 AM UTC
• Version: 1.0.1

Overview

The skill matches flight-price monitoring, but it needs Review because it relies on an unpinned global CLI install and persistent scheduled monitoring/history of travel plans.

Install only if you are comfortable using FlyAI/Fliggy for flight searches. Prefer pinning and auditing the CLI version, avoid running global npm installs with elevated privileges, keep any API key scoped, and confirm where scheduled tasks and `memory/flight-monitor/` history are stored and how to delete them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:49

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 49
Vulnerability Type: Unpinned global third-party dependency installation
Risk Level: Medium

Complete Code Snippet:

bash

npm i -g @fly-ai/flyai-cli

Technical Analysis

The Skill instructs users to globally install the latest available version of @fly-ai/flyai-cli. No reviewed version, lockfile, integrity hash, or provenance requirement is specified.

Because npm installation can execute package lifecycle scripts, a compromised publisher account, malicious future release, or compromised transitive dependency could execute code with the privileges of the user running the installation. The global -g scope also gives the package broader and more persistent system exposure than a project-local or isolated installation.

This finding does not establish that the current package is malicious. The vulnerability is the unsafe trust and installation model, which permits the package contents to change after the Skill has been reviewed.

Attack Path

1. An attacker compromises the npm publisher account, package release process, or a transitive dependency.
2. The attacker publishes a malicious version that becomes the latest resolvable release.
3. A user follows the Skill instructions and runs the unpinned global installation command.
4. npm downloads the attacker-controlled release.
5. Malicious package code or lifecycle scripts execute with the invoking user's permissions.
6. The installed global executable can remain available for subsequent invocations and may access files, credentials, network resources, and processes available to that user.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the account performing the installation. Depending on that account's privileges, the attacker could access user-readable files and credentials, modify user-owned configuration, communicate with external ser ...[truncated 350 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a specific, reviewed version rather than resolving the latest release:

   bash

   npm install --save-exact @fly-ai/flyai-cli@REVIEWED_VERSION
   

2. Prefer a project-local installation over -g, and invoke the binary from the local dependency context.
3. Commit and enforce a lockfile with integrity metadata where the deployment model permits it.
4. Verify npm provenance, publisher identity, package signatures, and integrity before installation.
5. Audit both the direct package and its transitive dependency tree.
6. Disable lifecycle scripts during installation unless the reviewed package explicitly requires them:

   bash

   npm install --ignore-scripts --save-exact @fly-ai/flyai-cli@REVIEWED_VERSION
   

7. Run the CLI in a least-privileged container or sandbox with narrowly scoped filesystem and network access.
8. Document a controlled upgrade process so new releases are reviewed before changing the pinned version.
9. Avoid running npm installation commands with administrator or root privileges.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger patterns are broad enough to capture generic flight-search requests, not just monitoring or alert intents. In an agent ecosystem, this can cause the wrong skill to activate, leading to unintended tool execution, unnecessary external API calls, and accidental persistence of user travel queries into the skill’s history files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly states that it writes repeated results into memory/flight-monitor, but it does not clearly warn users that their travel queries and monitoring history will be stored persistently. Because flight routes, dates, and booking interests can reveal sensitive travel patterns, silent persistence increases privacy risk and may retain data longer than users expect.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The instruction says the command usually accepts Chinese city names, which establishes a language-specific constraint in the skill guidance. The file does not offer an opt-in choice of language or explain that the skill is intentionally limited to a Chinese-language travel workflow, so this is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The entire skill reference is written in Chinese and provides examples using Chinese-language instructions and locations, with no indication that other languages are supported or that this locale is optional. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The entire template and instructional text are written in Chinese, establishing a fixed language expectation for the skill artifact. Under the policy, forcing a specific language without offering the user a language or locale choice is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file’s instructional content and examples are presented entirely in Chinese, which effectively forces a specific language for users consuming this skill reference. The policy allows locale constraints only when explicitly justified or when users are given a language/locale choice, neither of which appears here.

Content

No source excerpt is available for this finding.