Security audit
flightaware-mcp
Security checks across malware telemetry and agentic risk
Overview
This skill appears benign: it clearly sets up a FlightAware MCP integration using the user’s AeroAPI key and discloses its account-changing alert tools.
Install only if you are comfortable giving this MCP server your FlightAware AeroAPI key and letting it make FlightAware API calls that count against your quota or billing. Review alert changes carefully, especially deleting alerts or setting a webhook endpoint, and consider pinning the npm package version for repeatable installs.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
64/64 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.