ClawHub
Back to skill

Security audit

Flight Tracker for Airports in Asia Pacific

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward flight-schedule lookup tool that discloses its API key use and external services.

Install only if you are comfortable using an Aviationstack API key for flight lookups. Keep the key private, avoid committing ~/.openclaw/.env, and understand that route lookups and the API key are sent to Aviationstack.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Confidence
84% confidence
Finding
The Aviationstack API key is placed in the query string, which can be exposed through logs, proxies, browser/history-like tooling, or upstream telemetry even though the transport is HTTPS. In this script the exposure is limited because the endpoint itself expects this parameter, but transmitting credentials in URLs still increases accidental secret leakage risk.

Static analysis

No suspicious patterns detected.