ClawHub
Back to skill

Security audit

clawflight

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed flight-alert tool that stores travel details locally and sends alerts only through user-configured channels.

Install only if you are comfortable storing family itinerary details on this machine and sending alert text, including traveler names and confirmation codes, to the recipients and notification services you configure. Use a dedicated forwarding mailbox if enabling mail ingestion, keep secrets in environment variables, and review any cron jobs before applying setup.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding
The declared description presents a user-facing flight monitoring and alerting skill. The supplied code chunk instead is a persistence/merging layer for itinerary records. It handles local storage, record merging, person attribution, status updates, backup-booking grouping, and deletion/pruning. While some pieces are related to the broader domain (schedule-change note tagging, status fields, matching vendor updates, email confirmation ingestion), the main behaviors in this code are registry management rather than active tracking or notification. The code also processes and stores traveler names, confirmation codes, seats, source message identifiers, and notes in a local JSON file, which is a meaningful data access/storage behavior not reflected by the empty declared permissions. Therefore the description does not accurately represent what this code chunk actually does.

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
value is interpreted by a shell.
    """
    try:
        completed = subprocess.run(  # noqa: S603 - argv list, shell=False
            list(argv),
            timeout=timeout,
            capture_output=True,
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

External Transmission

Medium
Category
Data Exfiltration
Content
"""Live HTTP observations from two trusted, necessary public flight-data feeds.

The default destinations are ``https://api.adsb.lol/v2`` for public aircraft
positions and ``https://nasstatus.faa.gov/api/airport-status-information`` for
FAA airport conditions. Position requests transmit the public aircraft callsign
in the URL; FAA requests add no query data. Each request also sends only the
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
"""Live HTTP observations from two trusted, necessary public flight-data feeds.

The default destinations are ``https://api.adsb.lol/v2`` for public aircraft
positions and ``https://nasstatus.faa.gov/api/airport-status-information`` for
FAA airport conditions. Position requests transmit the public aircraft callsign
in the URL; FAA requests add no query data. Each request also sends only the
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The manifest describes tracking flights and sending alerts, but not managing host scheduling infrastructure. The `setup --apply` path invokes external `openclaw cron create` commands through a subprocess runner, which is a system-management capability rather than a direct flight-tracking function.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The manifest mentions forwarding airline confirmations and sending alerts, but does not mention running a loopback push receiver/server. This file adds a `serve` command that starts an HTTP receiver using environment-provided secrets, which is a distinct operational behavior from the described mailbox/notification flow.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The manifest describes tracking flights from forwarded confirmations, alerting recipients, muting alerts, and running diagnostics. This file also adds substantial administrative capabilities to create/remove people, recipients, flights, and mutate arbitrary configuration settings, which goes beyond the user-facing scope described in the manifest.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The code sends `entry.text` through an external `Poster` adapter, and that text can include traveler name, route, confirmation code, seat, and other itinerary details. Although the class docstring notes that the outbox stores personal travel data, there is no user-facing disclosure, confirmation prompt, or visible log at the point where the data is transmitted to a delivery channel.

Missing User Warnings

Low
Confidence
89% confidence
Finding
This code performs destructive state-removal operations via `del self._state[flight_id]` in both `forget` and `prune`, and those changes are persisted to disk by `_write_state()`. Although the methods have docstrings, there is no user-facing confirmation, prompt, or disclosure in the code around these deletions, so users may not be warned that tracking state will be permanently removed.

Natural-Language Policy Violations

Low
Confidence
80% confidence
Finding
The code maps `America/New_York` to the fixed locale-specific label `ET`, which imposes a particular regional time convention in generated natural-language output. There is no indication here that the user explicitly opted into this locale preference, so this may violate language/locale choice expectations.

Static analysis

No suspicious patterns detected.