ClawHub
Back to skill

Security audit

clawflight

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed flight-alert tool that stores travel details locally and sends alerts only through user-configured channels.

Install only if you are comfortable storing family itinerary details on this machine and sending alert text, including traveler names and confirmation codes, to the recipients and notification services you configure. Use a dedicated forwarding mailbox if enabling mail ingestion, keep secrets in environment variables, and review any cron jobs before applying setup.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The declared description presents a user-facing flight monitoring and alerting skill. The supplied code chunk instead is a persistence/merging layer for itinerary records. It handles local storage, record merging, person attribution, status updates, backup-booking grouping, and deletion/pruning. While some pieces are related to the broader domain (schedule-change note tagging, status fields, matching vendor updates, email confirmation ingestion), the main behaviors in this code are registry management rather than active tracking or notification. The code also processes and stores traveler names, confirmation codes, seats, source message identifiers, and notes in a local JSON file, which is a meaningful data access/storage behavior not reflected by the empty declared permissions. Therefore the description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · engine/clawflight/adapters/channel_openclaw.py (reported line 35)May include surrounding context.

python
value is interpreted by a shell.
    """
    try:
        completed = subprocess.run(  # noqa: S603 - argv list, shell=False
            list(argv),
            timeout=timeout,
            capture_output=True,

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · engine/clawflight/adapters/feed_adsb.py (reported line 3)May include surrounding context.

python
"""Live HTTP observations from two trusted, necessary public flight-data feeds.

The default destinations are ``https://api.adsb.lol/v2`` for public aircraft
positions and ``https://nasstatus.faa.gov/api/airport-status-information`` for
FAA airport conditions. Position requests transmit the public aircraft callsign
in the URL; FAA requests add no query data. Each request also sends only the

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · engine/clawflight/adapters/feed_adsb.py (reported line 32)May include surrounding context.

python
"""Live HTTP observations from two trusted, necessary public flight-data feeds.

The default destinations are ``https://api.adsb.lol/v2`` for public aircraft
positions and ``https://nasstatus.faa.gov/api/airport-status-information`` for
FAA airport conditions. Position requests transmit the public aircraft callsign
in the URL; FAA requests add no query data. Each request also sends only the

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest describes tracking flights and sending alerts, but not managing host scheduling infrastructure. The setup --apply path invokes external openclaw cron create commands through a subprocess runner, which is a system-management capability rather than a direct flight-tracking function.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The manifest mentions forwarding airline confirmations and sending alerts, but does not mention running a loopback push receiver/server. This file adds a serve command that starts an HTTP receiver using environment-provided secrets, which is a distinct operational behavior from the described mailbox/notification flow.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest describes tracking flights from forwarded confirmations, alerting recipients, muting alerts, and running diagnostics. This file also adds substantial administrative capabilities to create/remove people, recipients, flights, and mutate arbitrary configuration settings, which goes beyond the user-facing scope described in the manifest.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The code sends entry.text through an external Poster adapter, and that text can include traveler name, route, confirmation code, seat, and other itinerary details. Although the class docstring notes that the outbox stores personal travel data, there is no user-facing disclosure, confirmation prompt, or visible log at the point where the data is transmitted to a delivery channel.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

This code performs destructive state-removal operations via del self._state[flight_id] in both forget and prune, and those changes are persisted to disk by _write_state(). Although the methods have docstrings, there is no user-facing confirmation, prompt, or disclosure in the code around these deletions, so users may not be warned that tracking state will be permanently removed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The code maps America/New_York to the fixed locale-specific label ET, which imposes a particular regional time convention in generated natural-language output. There is no indication here that the user explicitly opted into this locale preference, so this may violate language/locale choice expectations.

Content

No source excerpt is available for this finding.