FlyClaw (Flight N-in-1 Search Zero Login)

• Outcome: Review
• Latest audit: May 28, 2026 · 6:03 AM UTC
• Version: 0.4.4

Overview

FlyClaw appears to be a real flight-search tool, but its default Fliggy integration quietly creates a persistent device identifier and sends device/context metadata despite broad privacy claims.

Review before installing. Use an isolated Python environment, pin dependencies if possible, and consider disabling the Fliggy source in config.yaml unless you are comfortable with a persistent device ID and device/context metadata being sent to Fliggy during searches.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill advertises broad operational behavior including network access, local file/cache handling, and even references to MCP-related components, but it declares no permissions. This creates a transparency and consent problem: hosts or users may execute a skill with more capability than they expect, especially since the documentation explicitly mentions cache files, config files, and remote data retrieval. In a security review, undeclared capabilities are a real risk because they weaken sandboxing assumptions and make policy enforcement harder.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The documentation makes strong trust-signaling claims like 'zero API key', 'no browser', and purely public-data querying, while the analyzed behavior reportedly includes optional API-key integrations, remote metadata downloads that can overwrite local files, and optional browser-based/extra tooling paths. That mismatch is dangerous because users and platforms may rely on the declared behavior when deciding whether to install or sandbox the skill; hidden or understated capabilities can enable unexpected external communication and local state changes. The risk is amplified here because the skill is explicitly positioned as low-friction and safe, which may reduce user scrutiny.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.28.0
pyyaml>=6.0
curl_cffi>=0.5.0
flights>=0.7.0

• Confidence: 93% confidence
• Finding: The dependency is specified with only a lower bound, so installations may resolve to different versions over time. This weakens reproducibility and can unintentionally pull in newly introduced vulnerable or breaking releases, which is a real supply-chain risk even though the file itself does not prove active exploitation.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.28.0
pyyaml>=6.0
curl_cffi>=0.5.0
flights>=0.7.0
cryptography>=42.0.0

• Confidence: 94% confidence
• Finding: PyYAML is also unpinned, allowing resolver-selected versions to vary by install time and environment. In a network-facing aggregation skill that may parse remote data or config, this increases supply-chain exposure and makes it harder to guarantee that a safe version is installed.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.28.0
pyyaml>=6.0
curl_cffi>=0.5.0
flights>=0.7.0
cryptography>=42.0.0
# Optional: mcp>=1.26.0 (MCP backend for Skiplagged, enable via mcp_enabled: true)

• Confidence: 95% confidence
• Finding: curl_cffi is unpinned, which is more concerning here because this skill is explicitly network-heavy and likely relies on HTTP behavior for multi-source scraping/aggregation. An unpinned transport library can silently introduce SSRF-relevant, TLS, redirect, or request-handling regressions into a package that interacts with many external endpoints.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.28.0
pyyaml>=6.0
curl_cffi>=0.5.0
flights>=0.7.0
cryptography>=42.0.0
# Optional: mcp>=1.26.0 (MCP backend for Skiplagged, enable via mcp_enabled: true)
# Optional: fast-flights>=3.0rc0 (--compare)

• Confidence: 89% confidence
• Finding: The flights package is unpinned, so builds are not reproducible and may consume unreviewed upstream changes. While the exact risk depends on how the package is used, unpinned third-party libraries in an automation skill create avoidable supply-chain uncertainty.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pyyaml>=6.0
curl_cffi>=0.5.0
flights>=0.7.0
cryptography>=42.0.0
# Optional: mcp>=1.26.0 (MCP backend for Skiplagged, enable via mcp_enabled: true)
# Optional: fast-flights>=3.0rc0 (--compare)
# Optional: playwright (--compare --browser)

• Confidence: 92% confidence
• Finding: cryptography is security-sensitive infrastructure, and leaving it unpinned means installers may pull different wheel builds or newer releases with different bundled OpenSSL versions. That creates avoidable variance in the security boundary of the skill.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: The requirements entry allows any requests version at or above 2.28.0, and the static analysis indicates multiple advisories affect the package family. Because this skill is network-centric and likely processes attacker-controllable URLs or responses from many external sources, unresolved requests vulnerabilities could enable credential leakage, TLS verification issues, or other HTTP-layer compromise depending on the resolved version and usage.

Known Vulnerable Dependency: pyyaml — 8 advisory(ies): CVE-2019-20477 (Deserialization of Untrusted Data in PyYAML); CVE-2020-1747 (Improper Input Validation in PyYAML); CVE-2020-14343 (Improper Input Validation in PyYAML) +5 more

Critical

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: PyYAML has a long history of unsafe deserialization issues, and the dependency is not constrained to a known-safe version. In a skill that may read YAML configuration or ingest externally influenced content, vulnerable PyYAML versions can enable code execution or unsafe object construction if unsafe loaders are used.

Known Vulnerable Dependency: curl_cffi — 2 advisory(ies): GHSA-3vpc-4p9p-47hc (curl_cffi bundles a version of libcurl affected by High Severity vulnerability); CVE-2026-33752 (curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (wi)

High

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: curl_cffi is reported with high-severity advisories including redirect-based SSRF concerns, which is especially dangerous in a flight aggregation skill that fetches from many remote services. If attacker-controlled URLs, redirects, or metadata endpoints are reachable through this client, exploitation could lead to internal network access, cloud metadata exposure, or proxy bypass.

Known Vulnerable Dependency: cryptography — 10 advisory(ies): GHSA-39hc-v87j-747x (Vulnerable OpenSSL included in cryptography wheels); CVE-2023-50782 (Python Cryptography package vulnerable to Bleichenbacher timing oracle attack); GHSA-5cpq-8wj7-hf2v (Vulnerable OpenSSL included in cryptography wheels) +7 more

High

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: The cryptography package is associated with multiple advisories, including issues tied to bundled OpenSSL versions, and the requirement does not ensure a fixed safe build. While exploitability depends on which cryptographic features are actually used, relying on a vulnerable crypto stack can undermine confidentiality, authenticity, or certificate validation in network operations.

Static analysis

No suspicious patterns detected.