Intelligent Hotel Lookup

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:51 AM UTC
• Version: 1.0.2

Overview

This is a disclosed hotel-search helper, with the main caution being its global third-party CLI install and persistent optional API-key setup.

Before installing, treat the FlyAI CLI like any other third-party global tool: prefer a pinned reviewed version, avoid sudo/admin installation, protect FLYAI_API_KEY, and expect hotel destinations, dates, budgets, and preferences to be sent to the FlyAI/Fliggy service when searches run.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:46

Finding

Unpinned Global npm Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 44–47
Vulnerability Type: Supply-chain exposure through an unpinned globally installed dependency
Risk Level: Medium

Affected code:

markdown

## Prerequisites

1. Install FlyAI CLI: `npm i -g @fly-ai/flyai-cli`
2. Optional richer results: `flyai config set FLYAI_API_KEY "your-key"` (keep secrets out of logs).

Technical Analysis

The documented installation command retrieves the current registry-selected version of @fly-ai/flyai-cli without specifying an exact version or verifying package integrity. Consequently, the code installed by two users—or by the same user at different times—can differ from the version considered during this audit.

npm installation can execute package lifecycle scripts such as preinstall, install, and postinstall. Because the package is installed globally, a compromised future release, compromised publisher account, or registry-level substitution could execute attacker-controlled code during installation and replace the globally available flyai executable. The audited project does not contain a lockfile, integrity hash, vendored artifact, or signature-verification procedure that constrains this dependency.

No evidence in the reviewed files establishes that the named package is currently malicious. The confirmed issue is the unsafe, non-reproducible dependency-installation instruction and its resulting supply-chain exposure.

Attack Path

1. An attacker compromises the package publisher, publishing workflow, or another relevant npm supply-chain component.
2. The attacker publishes a malicious version under the legitimate @fly-ai/flyai-cli package name.
3. A user follows SKILL.md and runs npm i -g @fly-ai/flyai-cli without an exact version.
4. npm selects and downloads the attacker-controlled release.
5. Malicious lifecycle code runs during installation, or the installed global flyai command exe ...[truncated 910 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the CLI to a reviewed exact version, for example:

  bash

  npm install --global @fly-ai/flyai-cli@<reviewed-exact-version>
  

• Record and verify the expected package integrity digest or cryptographic provenance before installation.
• Prefer a project-local dependency with a committed lockfile over a global installation, then invoke it through a controlled local path.
• Review dependency provenance, maintainers, lifecycle scripts, and transitive dependencies whenever updating the pinned version.
• Perform installation and execution as an unprivileged user; do not use sudo or an administrator shell.
• Where operationally feasible, initially install with lifecycle scripts disabled and explicitly review any scripts required by the package:

  bash

  npm install --ignore-scripts --save-exact @fly-ai/flyai-cli@<reviewed-exact-version>
  

• Run the CLI in a sandbox with only the network, filesystem, and credential access required for hotel searches.
• Keep FLYAI_API_KEY outside command histories and logs, and provide it to the process through a restricted secret-management mechanism.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The trigger patterns are broad and overlap with many ordinary hotel-related phrases, which can cause the skill to activate when a more specific or safer routing choice would be better. Over-triggering is primarily a security and reliability concern because it expands the skill’s invocation surface, increases unnecessary tool use, and may cause unintended handling of user travel data or booking-oriented workflows.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The file presents core usage in English but requires Chinese terms such as 酒店, 民宿, 客栈, destination examples like 杭州, and bed types like 大床房 without stating that the skill is China-specific or that Chinese input is required. This can amount to an implicit language/locale constraint without user opt-in or justification.

Content

No source excerpt is available for this finding.