ClawHub
Back to skill

Security audit

Flight Tracker

Security checks for vulnerabilities and agentic risk

Overview

This skill appears low-risk, but it overstates its flight-search automation and does not actually implement WhatsApp delivery or real fare filtering.

Before installing, treat this as a connectivity-check helper, not a dependable flight fare monitor. Confirm any cron job and WhatsApp delivery are explicitly configured by you, and do not rely on it for price alerts until real fare extraction and filtering are implemented.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
98% confidence
Finding
The script presents itself as performing targeted flight searches with fare, stop, duration, and arrival-time filtering, but it only tests whether several travel websites are reachable and records page length or errors. In an automation skill that may trigger downstream notifications or decisions, this is dangerous because users can rely on fabricated or misleading results, causing incorrect travel planning or false assurance that monitoring is working.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The inline documentation overstates the capability of the script, claiming it searches and filters flights by detailed criteria, while the code does not perform any parsing, extraction, or filtering. In the context of an agent skill intended for automated reporting, this discrepancy can mislead operators into trusting non-existent monitoring and can propagate false operational data to messaging channels like WhatsApp.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill explicitly states it will report flight-search results via WhatsApp, which involves transmitting user-relevant data to a third-party messaging platform without any notice, consent, or explanation of what data leaves the system. Even if the payload seems low sensitivity, external transmission creates privacy, metadata, and account-exposure risks, especially if phone numbers, travel preferences, or scheduling details are included.

Static analysis

No suspicious patterns detected.