ClawHub
Back to skill

Security audit

Flights

Security checks for vulnerabilities and agentic risk

Overview

This flight-search skill has a plausible purpose, but its reviewed package is missing the claimed local CLI and relies on mutable external install/runtime code.

Review this carefully before installing. Prefer installing uv through a safer verified package-manager path, run any dependency installation in a dedicated virtual environment, pin fast-flights to a reviewed version, and do not rely on this package as-is until the missing scripts/flights-search file is included or the documentation is corrected.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:14
Finding

Remote Installer Downloaded and Executed Without Integrity Verification

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:14
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Complete Code Snippet:

bash
curl -LsSf https://astral.sh/uv/install.sh | sh

Technical Analysis

The installation instruction streams a remotely hosted script directly into sh. The script is mutable external content whose exact version, checksum, and signature are not specified by the Skill. Although the documented URL uses HTTPS and belongs to the official uv domain, transport encryption alone does not guarantee that the returned script remains identical to the version reviewed.

This execution method prevents meaningful inspection before execution and makes the effective payload dependent on the remote server at installation time. Compromise of the hosting service, domain, release infrastructure, or maintainer account could replace the installer with attacker-controlled shell commands.

Installing uv is ancillary setup rather than core flight-search functionality. Automatically executing a remote installer with all privileges of the invoking user therefore exceeds the minimum access needed merely to document or perform a flight search.

Attack Path

  1. A user follows the prerequisite instructions in SKILL.md.
  2. curl requests the current content of https://astral.sh/uv/install.sh.
  3. The response is streamed directly to sh without version pinning, checksum verification, signature validation, or prior inspection.
  4. If the remote response has been maliciously modified, arbitrary shell commands execute with the user's current privileges.
  5. The payload can access or modify any files, credentials, processes, and configuration available to that user.

Impact Assessment

Successful exploitation provides arbitrary code execution under the account running the command. A malicious installer could read user-accessible credentials, alter shell configurati ...[truncated 396 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the curl | sh installation pattern.
  • Prefer installation through a trusted operating-system package manager with package-signing verification.
  • If a standalone release is required, pin a specific uv version and link to its immutable release artifact.
  • Download the artifact separately, verify a publisher-provided cryptographic signature or pinned SHA-256 checksum, and only then execute it.
  • Display the downloaded script for review before execution rather than streaming it directly into a shell.
  • Document that installation must occur as an unprivileged user and must not require sudo.
  • Record the verified version and checksum in the Skill so future audits can evaluate the exact installer being used.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:18
Finding

Unpinned Third-Party Package Is Automatically Retrieved for Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:18-23
Vulnerability Type: Insecure dependency management
Risk Level: Medium

Complete Code Snippet:

markdown
The `fast-flights` library is installed automatically on first run via `uvx` (cached after that). Or install manually: `pip install fast-flights`

## CLI Usage

```bash
uvx --with fast-flights python3 scripts/flights-search <origin> <destination> <date> [options]
text

### Technical Analysis

Both documented installation paths identify `fast-flights` only by package name. They do not pin an exact version, constrain transitive dependencies, or provide integrity hashes. Consequently, the code retrieved during a future invocation can differ from the dependency version available when the Skill was audited.

The `uvx --with fast-flights` command dynamically resolves and installs the package into the execution environment before invoking Python. The manual `pip install fast-flights` alternative has the same unpinned dependency risk. A compromised maintainer account, malicious upstream release, or compromised transitive dependency could therefore introduce attacker-controlled code.

The repository contains only `SKILL.md`; the declared `scripts/flights-search` executable is absent. Thus, the claimed local flight-search implementation cannot be inspected or invoked from the supplied artifact. This discrepancy further undermines reproducibility, although it does not by itself prove that the named external package is malicious.

### Attack Path

1. A user follows the documented CLI instructions or manually runs `pip install fast-flights`.
2. The package manager resolves the current package release and its current transitive dependencies from configured package indexes.
3. Because no versions or hashes are pinned, the resolved artifacts may differ from those originally intended or reviewed.
4. If an upstream package release, maintainer 
...[truncated 828 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin fast-flights to a reviewed exact version rather than resolving the latest release.
  • Pin all transitive dependencies through a committed lockfile.
  • Require cryptographic hashes for downloaded distributions, such as with a hash-locked requirements file.
  • Use a dedicated, unprivileged virtual environment with no unnecessary access to credentials or sensitive directories.
  • Disable or tightly control untrusted additional package indexes to reduce dependency-confusion exposure.
  • Include the claimed scripts/flights-search implementation in the Skill so its behavior can be audited.
  • Test installation from a clean environment and verify that the lockfile reproduces the same dependency artifacts.
  • Establish a dependency-update process that includes source review, vulnerability scanning, and explicit lockfile regeneration.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The skill instructs users to run uvx --with fast-flights without pinning a specific package version, so execution depends on whatever version is current at runtime. If the upstream package is compromised, updated with malicious code, or publishes a breaking change, users may execute unreviewed code in their environment during first run.

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
90% confidence
Finding

The documentation recommends curl ... | sh, which streams a remote script directly into the shell without giving the user a chance to inspect or verify it. If the host, distribution path, or network path is compromised, this can lead to arbitrary code execution on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md
## Prerequisites

- **Python 3.9+**
- **[uv](https://docs.astral.sh/uv/)** (recommended) — install with `curl -LsSf https://astral.sh/uv/install.sh | sh`

The `flights-search` CLI is bundled at `scripts/flights-search` in this skill directory.

Static analysis

No suspicious patterns detected.