ClawHub
Back to skill

Security audit

Flight Tracker

Security checks for vulnerabilities and agentic risk

Overview

This flight-tracking skill does what it says, but it sends the user's API key and flight lookup over unencrypted HTTP.

Review before installing. Use this only with a rotatable, low-impact AviationStack key and avoid untrusted networks unless the endpoint is changed to HTTPS or routed through a secure proxy/provider. Prefer a virtual environment with pinned dependencies, and avoid putting long-lived keys in shared or committed shell profile files.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/track_flight.py:32
Finding

API Credential and Flight Query Transmitted Over Plaintext HTTP

Content
View full analysis

Vulnerability Details

File Location: scripts/track_flight.py, lines 32-46
Vulnerability Type: Plaintext transmission of sensitive credentials
Risk Level: High

python
def fetch_flight_data(flight_number: str, api_key: str) -> dict:
    """Fetch flight data from AviationStack API"""
    base_url = "http://api.aviationstack.com/v1/flights"
    
    params = {
        'access_key': api_key,
        'flight_iata': flight_number.upper()
    }
    
    try:
        response = requests.get(base_url, params=params, timeout=10)
        response.raise_for_status()
        return response.json()
    except requests.exceptions.RequestException as e:
        print(f"Error fetching flight data: {e}")
        sys.exit(1)

Technical Analysis

The script sends the AviationStack API key as the access_key URL query parameter through an unencrypted HTTP connection. The requests library serializes these parameters into a URL resembling:

text
http://api.aviationstack.com/v1/flights?access_key=SECRET&flight_iata=AA100

Because HTTP provides neither transport encryption nor server authentication, network intermediaries can observe the API key and requested flight number. URL query parameters can also be retained in server, proxy, gateway, or monitoring logs.

An active network attacker could modify the response because its integrity is not protected. The application subsequently trusts the returned JSON and displays flight status, gates, times, and live-position information without an independent authenticity check.

Contacting a flight-data provider is necessary for the Skill's declared functionality. Transmitting reusable credentials and flight queries over plaintext transport, however, exceeds an acceptable least-exposure design. The insecure limitation is disclosed in SKILL.md and references/api-setup.md, but disclosure does not mitigate interception or tampering.

Attack

...[truncated 1364 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace the endpoint with an HTTPS endpoint:
    python
    base_url = "https://api.aviationstack.com/v1/flights"
  2. Use an AviationStack subscription that supports HTTPS, or select another flight-data provider that provides TLS on the required service tier.
  3. Do not silently fall back to HTTP when HTTPS is unavailable. Fail closed with an explicit error instead.
  4. If the provider supports it, transmit the credential in an authorization header rather than a URL query parameter. HTTPS remains mandatory even when headers are used.
  5. Rotate API keys that have already been transmitted through this implementation.
  6. Update SKILL.md and references/api-setup.md so they no longer recommend or normalize credential transmission over HTTP.
  7. Consider redacting request URLs from exception and diagnostic output to prevent future credential leakage if logging is added.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:30
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 30-33; also documented in references/api-setup.md, lines 40-44
Vulnerability Type: Unpinned dependency and non-reproducible installation
Risk Level: Medium

markdown
3. **Install dependencies:**
   ```bash
   pip3 install requests
   ```

The equivalent instruction in references/api-setup.md is:

markdown
### 3. Install Python Dependencies

The script requires the `requests` library:

```bash
pip3 install requests
text

### Technical Analysis

The installation instructions resolve the latest version of `requests` and its transitive dependencies at installation time. No exact versions, integrity hashes, lock file, or isolated virtual environment are specified. Consequently, the software installed by a user may differ from the dependency code that was present or expected during review.

The package name `requests` is legitimate and there is no evidence that the project intentionally references a malicious or typosquatted package. The risk arises from unrestricted future resolution and installation rather than from a currently identified malicious dependency.

Depending on the user's Python configuration, `pip3 install` may modify a global, user-wide, or otherwise shared Python environment. This broadens the impact of incompatible or compromised dependency releases beyond this Skill.

### Attack Path

1. A user follows the documented command `pip3 install requests`.
2. Pip queries its configured package index and dynamically resolves the current `requests` release and transitive dependencies.
3. If the configured index, selected package release, dependency release, or delivery path is compromised, attacker-controlled package installation code can execute during installation or import.
4. The malicious dependency code runs with the privileges of the user invoking pip or running the flight-tracking script.
5. If installation occ
...[truncated 887 chars]
Remediation
View remediation

Remediation Suggestions

  1. Create a dependency file containing reviewed, exact versions:
    text
    requests==<reviewed-version>
  2. Lock all transitive dependencies rather than pinning only the direct package.
  3. Record package hashes and require verification:
    bash
    python -m pip install --require-hashes -r requirements.txt
  4. Generate and review the lock file using a dependency-management tool such as pip-tools.
  5. Install dependencies in a dedicated virtual environment:
    bash
    python3 -m venv .venv
. .venv/bin/activate
python -m pip install --require-hashes -r requirements.txt
  6. Avoid recommending system-wide installation or execution as root.
  7. Periodically update pinned versions after vulnerability review and automated dependency scanning.
  8. Update both SKILL.md and references/api-setup.md so their setup instructions remain consistent.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Tainted flow: 'params' from os.environ.get (line 36, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
98% confidence
Finding

The code sends the AviationStack API key and user-supplied flight number as query parameters to a plain HTTP endpoint. Because the transport is unencrypted, the credential and request contents can be intercepted or modified by any network observer or man-in-the-middle, enabling API key theft and tampering with returned flight data.

Content

Scanner excerpt · scripts/track_flight.py (reported line 42)May include surrounding context.

python
}
    
    try:
        response = requests.get(base_url, params=params, timeout=10)
        response.raise_for_status()
        return response.json()
    except requests.exceptions.RequestException as e:

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The document explicitly states that the free tier is HTTP-only yet does not warn that API requests, including the API key, may be sent without transport encryption. In the context of a flight-tracking skill that relies on external API calls, this creates a realistic risk of credential interception or traffic tampering on untrusted networks, leading to account abuse or manipulated flight data.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/track_flight.py (reported line 22)May include surrounding context.

python
def get_api_key() -> Optional[str]:
    """Get API key from environment variable"""
    api_key = os.environ.get('AVIATIONSTACK_API_KEY')
    if not api_key:
        print("Error: AVIATIONSTACK_API_KEY environment variable not set")

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill requires access to environment variables and outbound network access, but it does not declare any explicit tool scope or permissions boundary. That makes the capability surface implicit rather than reviewable, increasing the chance that an agent invokes the skill without clear authorization controls or user awareness of what resources it will access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The notes state that the free tier uses no HTTPS, which means flight queries and API keys may be transmitted in cleartext over the network. Without an explicit warning, users may unknowingly expose credentials and travel-related data to interception or modification by anyone on the network path.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The setup guide instructs users to store a long-lived API key in shell profile files, which increases the chance of accidental exposure through dotfile backups, screen sharing, shared accounts, or committing configuration files to version control. While using environment variables is common, recommending persistent storage without any security guidance normalizes unsafe credential handling and can lead to unauthorized API use.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This finding is valid because the code explicitly transmits data to an external service at an HTTP URL. In this skill context, external transmission is expected for flight tracking, but using an insecure external endpoint makes the transmission materially dangerous by exposing the request and response to interception or modification.

Content

Scanner excerpt · scripts/track_flight.py (reported line 34)May include surrounding context.

python
def fetch_flight_data(flight_number: str, api_key: str) -> dict:
    """Fetch flight data from AviationStack API"""
    base_url = "http://api.aviationstack.com/v1/flights"
    
    params = {
        'access_key': api_key,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script performs flight lookups over plain HTTP without warning the user that both the API key and the requested flight number will traverse the network unencrypted. This exposes sensitive operational data and the credential to interception, and an attacker could also alter responses in transit to mislead the user about flight status.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill description encourages users to submit flight numbers for lookup but does not clearly disclose that those queries will be sent to a third-party service. Even if flight numbers are often low sensitivity, they can reveal travel plans or personal itinerary details, so lack of disclosure creates a privacy and consent risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.