The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The README and setup.sh files promote an installation pattern where a remote shell script is downloaded and piped directly into the system shell (curl -fsSL ... | bash). This allows the execution of unverified code from the author's GitHub repository on the user's machine, posing a significant risk of arbitrary code execution.\n- [COMMAND_EXECUTION]: The skill relies on executing various CLI tools (flyai, mcporter, python) through shell commands to perform its core functions. This broad command execution capability increases the potential impact of malicious manipulation if input data is not strictly validated.\n- [EXTERNAL_DOWNLOADS]: The install.sh script installs several third-party Node.js packages (e.g., @fly-ai/flyai-cli, mcporter, xiaohongshu-mcp, grok-search-mcp) from external registries. These packages are not pinned to specific versions and originate from external maintainers.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes content from untrusted external sources, such as Xiaohongshu posts and general web search results, without explicit sanitization or boundary markers.\n
Ingestion points: Untrusted data enters the agent context through the outputs of the flyai, mcporter (Xiaohongshu), and grok-search tools mentioned in skill.md.\n
Boundary markers: None identified. The skill does not use delimiters or warnings to isolate untrusted content from its instructions.\n
Capability inventory: The skill has the ability to execute shell commands, perform network operations via curl, and write to the local file system using generate.py.\n
Sanitization: None identified. The skill incorporates raw search results into its JSON data and HTML templates without validation or filtering.

travel-planner