ClawHub
Back to skill

Security audit

Flights

Security checks across malware telemetry and agentic risk

Overview

The skill appears to be a coherent flight-search helper; its main caution is a disclosed optional installer command that pipes a remote uv install script into a shell.

Before installing, consider using a package manager or the official uv installation instructions instead of piping a remote script directly into `sh`. Install only if you are comfortable with uv as a dependency and with the skill running its bundled flight-search CLI.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Script Fetching

Low
Category
Supply Chain
Content
## Prerequisites

- **Python 3.9+**
- **[uv](https://docs.astral.sh/uv/)** (recommended) — install with `curl -LsSf https://astral.sh/uv/install.sh | sh`

The `flights-search` CLI is bundled at `scripts/flights-search` in this skill directory.
Confidence
95% confidence
Finding
curl -LsSf https://astral.sh/uv/install.sh | sh

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.