Flights

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:23 AM UTC
• Version: 1.2.0

Overview

This flight-search skill has a plausible purpose, but its reviewed package is missing the claimed local CLI and relies on mutable external install/runtime code.

Review this carefully before installing. Prefer installing uv through a safer verified package-manager path, run any dependency installation in a dedicated virtual environment, pin fast-flights to a reviewed version, and do not rely on this package as-is until the missing scripts/flights-search file is included or the documentation is corrected.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:14
• Finding: Remote Installer Downloaded and Executed Without Integrity Verification## Vulnerability Details **File Location**: `SKILL.md:14` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Complete Code Snippet**: ```bash curl -LsSf https://astral.sh/uv/install.sh | sh ``` ### Technical Analysis The installation instruction streams a remotely hosted script directly into `sh`. The script is mutable external content whose exact version, checksum, and signature are not specified by the Skill. Although the documented URL uses HTTPS and belongs to the official `uv` domain, transport encryption alone does not guarantee that the returned script remains identical to the version reviewed. This execution method prevents meaningful inspection before execution and makes the effective payload dependent on the remote server at installation time. Compromise of the hosting service, domain, release infrastructure, or maintainer account could replace the installer with attacker-controlled shell commands. Installing `uv` is ancillary setup rather than core flight-search functionality. Automatically executing a remote installer with all privileges of the invoking user therefore exceeds the minimum access needed merely to document or perform a flight search. ### Attack Path 1. A user follows the prerequisite instructions in `SKILL.md`. 2. `curl` requests the current content of `https://astral.sh/uv/install.sh`. 3. The response is streamed directly to `sh` without version pinning, checksum verification, signature validation, or prior inspection. 4. If the remote response has been maliciously modified, arbitrary shell commands execute with the user's current privileges. 5. The payload can access or modify any files, credentials, processes, and configuration available to that user. ### Impact Assessment Successful exploitation provides arbitrary code execution under the account running the command. A malicious installer could read user-accessible credentials, alter shell configurati ...[truncated 396 chars]
• Remediation: ## Remediation Suggestions - Remove the `curl | sh` installation pattern. - Prefer installation through a trusted operating-system package manager with package-signing verification. - If a standalone release is required, pin a specific `uv` version and link to its immutable release artifact. - Download the artifact separately, verify a publisher-provided cryptographic signature or pinned SHA-256 checksum, and only then execute it. - Display the downloaded script for review before execution rather than streaming it directly into a shell. - Document that installation must occur as an unprivileged user and must not require `sudo`. - Record the verified version and checksum in the Skill so future audits can evaluate the exact installer being used.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:18
• Finding: Unpinned Third-Party Package Is Automatically Retrieved for Execution## Vulnerability Details **File Location**: `SKILL.md:18-23` **Vulnerability Type**: Insecure dependency management **Risk Level**: Medium **Complete Code Snippet**: ```markdown The `fast-flights` library is installed automatically on first run via `uvx` (cached after that). Or install manually: `pip install fast-flights` ## CLI Usage ```bash uvx --with fast-flights python3 scripts/flights-search <origin> <destination> <date> [options] ``` ``` ### Technical Analysis Both documented installation paths identify `fast-flights` only by package name. They do not pin an exact version, constrain transitive dependencies, or provide integrity hashes. Consequently, the code retrieved during a future invocation can differ from the dependency version available when the Skill was audited. The `uvx --with fast-flights` command dynamically resolves and installs the package into the execution environment before invoking Python. The manual `pip install fast-flights` alternative has the same unpinned dependency risk. A compromised maintainer account, malicious upstream release, or compromised transitive dependency could therefore introduce attacker-controlled code. The repository contains only `SKILL.md`; the declared `scripts/flights-search` executable is absent. Thus, the claimed local flight-search implementation cannot be inspected or invoked from the supplied artifact. This discrepancy further undermines reproducibility, although it does not by itself prove that the named external package is malicious. ### Attack Path 1. A user follows the documented CLI instructions or manually runs `pip install fast-flights`. 2. The package manager resolves the current package release and its current transitive dependencies from configured package indexes. 3. Because no versions or hashes are pinned, the resolved artifacts may differ from those originally intended or reviewed. 4. If an upstream package release, maintainer ...[truncated 828 chars]
• Remediation: ## Remediation Suggestions - Pin `fast-flights` to a reviewed exact version rather than resolving the latest release. - Pin all transitive dependencies through a committed lockfile. - Require cryptographic hashes for downloaded distributions, such as with a hash-locked requirements file. - Use a dedicated, unprivileged virtual environment with no unnecessary access to credentials or sensitive directories. - Disable or tightly control untrusted additional package indexes to reduce dependency-confusion exposure. - Include the claimed `scripts/flights-search` implementation in the Skill so its behavior can be audited. - Test installation from a clean environment and verify that the lockfile reproduces the same dependency artifacts. - Establish a dependency-update process that includes source review, vulnerability scanning, and explicit lockfile regeneration.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The skill instructs users to run `uvx --with fast-flights` without pinning a specific package version, so execution depends on whatever version is current at runtime. If the upstream package is compromised, updated with malicious code, or publishes a breaking change, users may execute unreviewed code in their environment during first run.

External Script Fetching

Low

• Category: Supply Chain

Content

## Prerequisites

- **Python 3.9+**
- **[uv](https://docs.astral.sh/uv/)** (recommended) — install with `curl -LsSf https://astral.sh/uv/install.sh | sh`

The `flights-search` CLI is bundled at `scripts/flights-search` in this skill directory.

• Confidence: 90% confidence
• Finding: The documentation recommends `curl ... | sh`, which streams a remote script directly into the shell without giving the user a chance to inspect or verify it. If the host, distribution path, or network path is compromised, this can lead to arbitrary code execution on the user's machine.

Static analysis

No suspicious patterns detected.