Scan Report
5 /100
flyai-vacation-planner
智能拼假日历助手，帮助用户计算最优请假方案并查询机票价格
Pure documentation-only skill with no executable code; all capabilities (CLI tool install, filesystem read for user profiles, network via FlyAI CLI) are fully declared in SKILL.md and reference docs.
Safe to install
No action needed. This skill is safe to use as-is.
| Resource | Declared | Inferred | Status | Evidence |
|---|---|---|---|---|
| Filesystem | READ | READ | ✓ Aligned | SKILL.md:64; reference/user-profile-storage.md:43 |
| Network | READ | READ | ✓ Aligned | SKILL.md:43-44; flyai CLI commands in reference/*.md |
| Shell | WRITE | WRITE | ✓ Aligned | SKILL.md:43 npm install -g @fly-ai/flyai-cli@latest |
3 findings
Medium External URL 外部 URL
https://registry.npmmirror.com SKILL.md:40 Medium External URL 外部 URL
https://img.alicdn.com/... reference/search-hotel.md:44 Medium External URL 外部 URL
https://img.alicdn.com/tfscom/... reference/search-poi.md:32 File Tree
13 files · 27.5 KB · 883 lines Markdown 13f · 883L
├─
▾
reference
│ ├─
ai-search.md
Markdown
│ ├─
examples.md
Markdown
│ ├─
holidays-cn.md
Markdown
│ ├─
keyword-search.md
Markdown
│ ├─
search-flight.md
Markdown
│ ├─
search-hotel.md
Markdown
│ ├─
search-marriott-hotel.md
Markdown
│ ├─
search-marriott-package.md
Markdown
│ ├─
search-poi.md
Markdown
│ ├─
search-train.md
Markdown
│ ├─
user-profile-storage.md
Markdown
│ └─
visa-rules.md
Markdown
└─
SKILL.md
Markdown
Dependencies 1 items
| Package | Version | Source | Known Vulns | Notes |
|---|---|---|---|---|
@fly-ai/flyai-cli | latest | npm (registry.npmjs.org) | No | Version pinned to @latest; package source declared in SKILL.md |
Security Positives
✓ Documentation-only: zero executable code (scripts, binaries, or bytecode) present
✓ All external capabilities (npm install, FlyAI CLI network calls, filesystem user profile) fully declared in SKILL.md
✓ No obfuscation (no base64, no eval, no encoded payloads)
✓ No credential harvesting or sensitive path access (~/.ssh, ~/.aws, .env not touched)
✓ No C2 communication, reverse shells, or data exfiltration behavior
✓ No supply chain risk: npm package pinned to @latest tag from official registry; no unpinned dependencies
✓ User profile data stays local in ~/.flyai/ — no exfiltration of personal information