Flight Search

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:34 AM UTC
• Version: 0.1.7

Overview

The flight-search skill mostly does what it says, but its install and update paths can run mutable remote code or upgrade local packages without pinning.

Review the install path before using this skill. Prefer pinned, standard package-manager installation over the README curl-to-bash command, avoid running --upgrade in managed environments without approval, and assume flight search details such as airports, dates, and passenger counts may be sent to Google or the underlying scraper service.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:39

Finding

Unverified Remote Installation Script Piped Directly to Bash

Content

View full analysis

Vulnerability Details

File Location: README.md:39
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

bash

# one-liner
curl -fsSL https://raw.githubusercontent.com/Olafs-World/flight-search/main/install.sh | bash

Technical Analysis

The documented installation command downloads a shell script from the mutable main branch of a personal GitHub repository and immediately executes it with Bash. The payload is not pinned to an immutable commit, authenticated with a release signature, or checked against a published cryptographic hash. Piping the response directly to a shell also prevents the user from reviewing the exact content before execution.

The currently reviewed install.sh only selects an available Python package manager and installs flight-search. However, the effective payload is the content served remotely at execution time, not necessarily the version audited in this project. The remote script can therefore change after review.

This execution mechanism is not required for the Skill's flight-search functionality. The README and SKILL.md already provide direct package installation alternatives such as uv tool install flight-search and pip install flight-search.

Attack Path

1. An attacker compromises the GitHub repository, its maintainer account, or another component capable of modifying the remote main branch.
2. The attacker replaces or modifies install.sh to include malicious shell commands.
3. A user or automated Agent follows the README installation command.
4. curl retrieves the attacker-controlled version without pinning or integrity verification.
5. Bash immediately executes the response.
6. The payload operates with all permissions available to the invoking user and may access or alter resources available to that account.

Impact Assessment

Successful exploitation permits arbitrary command execution und ...[truncated 471 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the pipe-to-shell installation command and make a standard package-manager command the primary installation method:

  bash

  uv tool install flight-search
  

  or:

  bash

  python -m pip install flight-search
  

• If distributing a shell installer remains necessary, publish it as a versioned release artifact rather than retrieving it from a mutable branch.

• Pin retrieval to an immutable commit or release version.

• Publish a SHA-256 checksum or cryptographic signature through an independent trusted release channel.

• Require users to download, verify, inspect, and then execute the script as separate steps.

• Avoid recommending privileged execution and explicitly document the permissions and filesystem changes required by the installer.

T03 · Remote Payload Retrieval and Execution

Warning

• Location: install.sh:18

Finding

Installer Recommends Executing an Unverified Third-Party Remote Script

Content

View full analysis

Vulnerability Details

File Location: install.sh:18-21
Vulnerability Type: Remote payload retrieval and execution guidance
Risk Level: Medium

Vulnerable Code:

bash

else
  echo "❌ No Python package manager found (uv, pipx, or pip)"
  echo "Install uv: curl -LsSf https://astral.sh/uv/install.sh | sh"
  exit 1
fi

Technical Analysis

This branch does not automatically execute the remote script; it prints a command for the user to copy and run. Nevertheless, the recommended command downloads mutable content from https://astral.sh/uv/install.sh and passes it directly to a shell without content inspection, version pinning, checksum validation, or signature verification.

The endpoint belongs to the upstream uv project rather than an unknown package host, which reduces but does not eliminate the supply-chain risk. The command's effective payload remains controlled by remote content that may change after this audit. Installing another package-management tool also exceeds what is strictly necessary because the script has already checked for standard Python package managers and can instead direct users to official, verifiable installation documentation.

Attack Path

1. An attacker compromises the upstream installer distribution infrastructure, its publishing account, or another component that controls the response from the installer URL.
2. The user runs install.sh on a system without uv, pipx, pip3, or pip.
3. The script prints the remote pipe-to-shell command.
4. The user follows that recommendation.
5. The attacker-controlled response is passed directly to sh.
6. The payload executes with the permissions of the user who entered the command.

Impact Assessment

If the recommendation is followed after an upstream compromise, it can result in arbitrary command execution with the invoking user's privileges. This may expose user-readable data, modify account-level confi ...[truncated 299 chars]

Remediation

View remediation

Remediation Suggestions

• Do not print a pipe-to-shell command. Refer users to the official uv installation documentation over HTTPS instead.
• Where command-line installation instructions are necessary, use a staged process:
  1. Download a versioned installer artifact.
  2. Verify its published checksum or signature.
  3. Allow the user to inspect it.
  4. Execute the verified local file.
• Pin instructions to a documented release version rather than a mutable installer endpoint.
• Clearly state which files and environment settings the third-party installer will modify.
• Retain the existing non-privileged behavior and do not recommend sudo unless a separately documented system-wide installation explicitly requires it.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (17)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · CHANGELOG.md (reported line 24)May include surrounding context.

md

- Lint errors that prevented 0.1.5 from publishing to PyPI

### Added
- `--upgrade` flag to self-update (auto-detects uv/pipx/pip)

## [0.1.5] - 2026-02-06 (not published)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · CHANGELOG.md (reported line 29)May include surrounding context.

md

- Lint errors that prevented 0.1.5 from publishing to PyPI

### Added
- `--upgrade` flag to self-update (auto-detects uv/pipx/pip)

## [0.1.5] - 2026-02-06 (not published)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

Piping downloaded content directly into bash creates a chaining pattern that turns remote content retrieval into immediate shell execution. In the context of a developer tool README, this materially increases exploitability because copy-paste installation commands are likely to be run verbatim, giving an attacker a straightforward path to arbitrary command execution if the fetched content is altered.

Content

Scanner excerpt · README.md (reported line 39)May include surrounding context.

bash

# one-liner
curl -fsSL https://raw.githubusercontent.com/Olafs-World/flight-search/main/install.sh | bash

# using uv (recommended)
uv tool install flight-search

Self-Modification

High

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

The documented flight-search --upgrade self-update behavior encourages the installed tool to modify itself by fetching and installing newer code outside a normal reviewed deployment workflow. In managed or security-sensitive environments, this undermines change control and can expose users to malicious or compromised upstream releases.

Content

Scanner excerpt · README.md (reported line 167)May include surrounding context.

• ClawHub Skill
• fast-flights (underlying library)

Self-Update

bash

# Auto-detects how you installed it (uv/pipx/pip) and upgrades

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill executes external package-management commands (uv, pipx, pip) even though its declared function is flight search. This is dangerous because package-management subprocesses can change the host environment, fetch and install code from external sources, and become a supply-chain execution path if triggered by an agent or user who expects only read-only search behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README advertises flight searching but does not clearly warn that user queries are sent to external services and that the tool may rely on scraping or browser automation. This can mislead users about privacy, network activity, and operational behavior, especially in enterprise or restricted environments where outbound data transfer and automated browsing are sensitive.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 65% confidence

Finding

uvx/uv tool run commands without ==version create a rug-pull risk.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill advertises shell-capable installation and execution paths (uvx, uv tool install) but does not declare any explicit tool scope such as permissions or allowed-tools. That can cause an agent or reviewer to underestimate the command-execution capability of the skill, increasing the chance of unintended shell use or over-broad execution in environments that rely on declared scope for policy enforcement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill explicitly searches Google Flights, which necessarily sends user-provided itinerary details such as origin, destination, and travel dates to an external service, but the documentation does not disclose that data sharing. Users may expose sensitive travel plans without informed consent, which is especially risky in enterprise or high-privacy contexts.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The example uvx flight-search references an unpinned package/version, so execution may fetch and run whatever version is current at invocation time. This creates a supply-chain risk: if the package is compromised, typosquatted, or a malicious update is published, users or agents could execute attacker-controlled code.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · flight_search/cli.py (reported line 25)May include surrounding context.

python

if shutil.which("uv"):
        # Check if uv knows about this tool
        try:
            result = subprocess.run(
                ["uv", "tool", "list"],
                capture_output=True,
                text=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · flight_search/cli.py (reported line 39)May include surrounding context.

python

# Check for pipx installation
    if shutil.which("pipx"):
        try:
            result = subprocess.run(
                ["pipx", "list"],
                capture_output=True,
                text=True,

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The CLI includes a self-upgrade capability that is unrelated to its stated purpose of searching flights, increasing attack surface and introducing package-management behavior into a routine utility. In agent or automation contexts, this can unexpectedly modify the local environment, pull new code from package indexes, and bypass normal software update controls.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · flight_search/cli.py (reported line 70)May include surrounding context.

python

cmd = [sys.executable, "-m", "pip", "install", "--upgrade", "flight-search"]

    try:
        subprocess.run(cmd, check=True)
        print("\n✅ Upgrade complete! Run 'flight-search --version' to verify.")
        return 0
    except subprocess.CalledProcessError as e:

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The README includes a curl ... | bash one-liner that fetches a remote script and immediately executes it. This is dangerous because users cannot inspect the script before execution, and any compromise of the GitHub account, repository, branch, or network path could lead to arbitrary code execution on the user's system.

Content

Scanner excerpt · README.md (reported line 39)May include surrounding context.

bash

# one-liner
curl -fsSL https://raw.githubusercontent.com/Olafs-World/flight-search/main/install.sh | bash

# using uv (recommended)
uv tool install flight-search

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 15% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · install.sh (reported line 20)May include surrounding context.

sh

pip install --user flight-search
else
  echo "❌ No Python package manager found (uv, pipx, or pip)"
  echo "Install uv: curl -LsSf https://astral.sh/uv/install.sh | sh"
  exit 1
fi

Unverifiable Dependency: pytest has 2 known advisory(ies) (CVE-2025-71176 (pytest has vulnerable tmpdir handling); CVE-2025-71176 (pytest has vulnerable tmpdir handling)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.