Flight Search

• Analyzed: May 12, 2026, 3:31 AM
• Findings: 1
• Version: 0.1.7
• Hash: fde4fbb3f0ee9f41021a0f50a1f4190c4e917ccc36e2001d95de970e2f3eb6c5
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as benign. Its primary function is to search Google Flights using the `fast-flights` library, which involves web scraping. The `SKILL.md` provides standard installation instructions for `uv` via `pip`. The `cli.py` file uses `subprocess.run` for a legitimate self-update feature (`--upgrade` flag) that specifically targets the `flight-search` package itself, not arbitrary commands. While `install.sh` and `README.md` contain `curl | bash` instructions for users to install `uv`, these are user-facing instructions and not executed by the OpenClaw agent during skill installation or runtime, as the agent's `SKILL.md` specifies a `pip` installation for `uv`. There is no evidence of data exfiltration, persistence, or prompt injection against the agent.