Security audit

Flight Search

Security checks across malware telemetry and agentic risk

Overview

This is a flight-search CLI skill with some disclosed package-install and self-update behavior, but I did not find evidence of hidden exfiltration, persistence, or destructive actions.

Install through uv, pipx, or pip from a version you trust rather than piping a remote install script directly to bash. Treat --upgrade as a local environment change, and use it only when you intend to update the installed flight-search package.

SkillSpector

By NVIDIA

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 78% confidence
Finding: The skill advertises and demonstrates shell execution capability via `uvx` and `uv tool install`, but does not declare any permissions for that capability. This creates a trust and review gap: users or hosting platforms may treat the skill as lower-risk than it is, even though using it requires invoking external binaries and installing/running package code from PyPI.

Description-Behavior Mismatch

Low

Confidence: 82% confidence
Finding: The README documents a self-update capability that is not necessary for the stated purpose of searching flights. While not inherently malicious, adding package-management behavior broadens the skill’s operational scope and creates an unnecessary path for code changes or supply-chain exposure beyond core flight-search functionality.

Context-Inappropriate Capability

Low

Confidence: 87% confidence
Finding: Documenting `flight-search --upgrade` introduces software installation and package-management behavior unrelated to the skill’s declared role. In an agent-skill context, this increases risk because a seemingly harmless utility may trigger environment modifications, which can be abused for persistence, unexpected dependency changes, or supply-chain compromise.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The CLI includes self-upgrade behavior that is outside the stated purpose of searching flights, which means the skill can modify the local environment and install new code. In an agent or automation context, this is dangerous because a seemingly read-only informational tool gains software-management capability and may trigger unintended package installation or updates from external repositories.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The code executes external package-manager commands (uv, pipx, pip) that are unrelated to flight-search functionality. In the context of an agent skill, invoking package managers expands the capability from data retrieval to software installation, creating supply-chain, environment-modification, and privilege-abuse risks if the feature is triggered in unattended or high-trust environments.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The README recommends `curl ... | bash`, which executes a remote script directly without inspection or integrity verification. This is dangerous because compromise of the repository, network path, or hosting source could lead users to run arbitrary attacker-controlled code on their systems.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.