Pipeworx flights

• Risk level: Low
• Analyzed: Apr 8, 2026, 7:22 PM
• Findings: 0
• Version: 1.0.0

Overview

The skill matches its stated purpose (querying OpenSky data via a Pipeworx gateway) and asks for no credentials, but the docs recommend running remote code via npx which introduces a moderate operational risk you should consider.

This skill appears to do what it says: query live flight data via the Pipeworx gateway (no API keys needed). Before using, decide whether you trust the gateway (gateway.pipeworx.io) to proxy your requests. If you don't want to run remote code, use the provided curl example rather than the MCP `npx mcp-remote@latest` snippet — running `npx -y` fetches and executes the latest package from npm and can run arbitrary code. If you plan to use the MCP config, review the `mcp-remote` package source/version and the Pipeworx service policies first.