ClawHub
Back to skill

Security audit

Flight Tracker

Security checks for vulnerabilities and agentic risk

Overview

This flight-tracking skill is purpose-aligned, but it sends the user's AviationStack API key and flight lookup over plaintext HTTP.

Review before installing. Use this only if you accept that flight numbers and your AviationStack API key may be sent over unencrypted HTTP on the free tier. Prefer an HTTPS-capable plan or another provider, rotate any key previously used over HTTP, and install dependencies in an isolated environment with pinned versions where possible.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/track_flight.py:34
Finding

API Credential Transmitted over Plaintext HTTP

Content
View full analysis

Vulnerability Details

File Location: scripts/track_flight.py:34-41
Vulnerability Type: Plaintext transmission of sensitive credentials
Risk Level: High

python
base_url = "http://api.aviationstack.com/v1/flights"

params = {
    'access_key': api_key,
    'flight_iata': flight_number.upper()
}

response = requests.get(base_url, params=params, timeout=10)

Technical Analysis

The script sends the AviationStack API key through an unencrypted HTTP request. Because access_key is a query-string parameter, the credential is visible to any network intermediary capable of observing the request. It may also be retained in proxy, gateway, monitoring, or server access logs.

HTTP provides neither transport confidentiality nor server authenticity. An on-path attacker can therefore read the API key, observe requested flight numbers, modify the API response, or impersonate the API endpoint. The documentation acknowledges that the selected free tier is HTTP-only, but disclosure does not mitigate the underlying credential exposure.

The external API request is necessary for the declared flight-tracking function. Transmitting its credential without TLS, however, is not a safe least-exposure implementation.

Attack Path

  1. A user configures AVIATIONSTACK_API_KEY and runs the flight-tracking script.
  2. The script constructs an HTTP request whose URL query contains both the API key and flight number.
  3. An attacker controlling or monitoring a local network, wireless access point, router, transparent proxy, ISP path, or other intermediary captures the plaintext request.
  4. The attacker extracts the access_key query parameter and reuses the credential against AviationStack.
  5. The attacker can consume the account quota or perform other operations permitted by that API key.
  6. An active on-path attacker can additionally alter the returned JSON, causing the script to display false flight status, loca ...[truncated 610 chars]
Remediation
View remediation

Remediation Suggestions

  • Require an HTTPS-capable AviationStack plan or migrate to a flight-data provider that supports TLS for all account tiers.
  • Refuse to send the API key when the configured endpoint uses http://.
  • Where supported by the provider, place credentials in an authorization header rather than a URL query string to reduce exposure in URL logs.
  • Keep certificate verification enabled and do not introduce options such as verify=False.
  • Rotate any API key previously used by this implementation because it may already have traversed or been retained by untrusted intermediaries.
  • Add a regression test that verifies the endpoint scheme is HTTPS before any request is issued.
  • Clearly document the network destination and data transmitted, but do not treat documentation alone as an adequate security control.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:32
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:32-35
Vulnerability Type: Unpinned and non-reproducible dependency installation
Risk Level: Medium

bash
# Install dependencies:
pip3 install requests

The same unpinned installation instruction is also repeated in references/api-setup.md:33-37.

Technical Analysis

The setup instructions install requests without a fixed version, lock file, or package hash. Consequently, installation behavior can change independently of the reviewed Skill: pip will resolve whichever compatible package and transitive dependency versions are available at installation time.

This does not demonstrate that the current requests package is malicious. The risk arises because the Skill does not provide a reproducible, integrity-verified dependency set. A compromised package-index account, malicious future release, altered index configuration, or compromised transitive dependency could introduce code that was never included in this audit.

The instructions also do not recommend an isolated virtual environment. Depending on the user’s pip configuration, the package could be installed into a shared user or system Python environment and affect unrelated applications.

Attack Path

  1. A user follows the documented command pip3 install requests.
  2. Pip contacts its configured package index and resolves the current requests release and its transitive dependencies.
  3. If the index, package publisher, selected release, local index configuration, or a transitive dependency has been compromised, pip retrieves attacker-controlled package content.
  4. Package installation mechanisms or later imports execute the supplied code with the privileges of the installing or invoking user.
  5. The malicious dependency can then access data available to that user, including environment variables such as AVIATIONSTACK_API_KEY, and can affect other Python applications sharing the same enviro ...[truncated 641 chars]
Remediation
View remediation

Remediation Suggestions

  • Add a reviewed, version-pinned dependency file rather than directing users to install an unconstrained package.
  • Generate a hash-locked requirements file and require hash verification, for example through pip install --require-hashes -r requirements.txt.
  • Pin transitive dependencies as well as the direct requests dependency to make installations reproducible.
  • Review and regularly update pinned versions to incorporate security fixes rather than leaving them indefinitely frozen.
  • Instruct users to create and activate a dedicated virtual environment before installation.
  • Explicitly use the intended trusted package index and review pip configuration where installation integrity is important.
  • Avoid recommending installation with root or administrator privileges.
  • Keep SKILL.md and references/api-setup.md synchronized so both use the hardened installation procedure.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Tainted flow: 'params' from os.environ.get (line 36, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
99% confidence
Finding

The API key sourced from the environment is transmitted as a URL query parameter to an HTTP endpoint, so it can be exposed in plaintext over the network and in intermediary logs, proxies, or monitoring systems. Because the request is not protected by TLS, both the credential and the user's flight query are vulnerable to interception or tampering by anyone on the network path.

Content

Scanner excerpt · scripts/track_flight.py (reported line 42)May include surrounding context.

python
}
    
    try:
        response = requests.get(base_url, params=params, timeout=10)
        response.raise_for_status()
        return response.json()
    except requests.exceptions.RequestException as e:

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill explicitly notes that the free API tier uses no HTTPS, which means flight queries and API credentials may be transmitted over an unencrypted connection. This exposes sensitive data to interception or tampering by attackers on the network path, making the issue materially more dangerous in this context because the skill relies on an API key and live request traffic.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/track_flight.py (reported line 22)May include surrounding context.

python
def get_api_key() -> Optional[str]:
    """Get API key from environment variable"""
    api_key = os.environ.get('AVIATIONSTACK_API_KEY')
    if not api_key:
        print("Error: AVIATIONSTACK_API_KEY environment variable not set")

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill documentation indicates capabilities that access environment variables and make outbound network requests, but it does not declare any tool scope or allowed-tools boundaries. This weakens transparency and policy enforcement, increasing the risk that the skill can access sensitive configuration such as API keys and contact external services without an explicit permission model.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill states it uses the AviationStack API, but it does not clearly inform users that flight numbers, timing, and related query data will be sent to a third-party provider. This creates a privacy and consent issue because user requests may reveal travel plans or other sensitive itinerary information to an external service without explicit warning.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document explicitly notes that the free tier supports only HTTP, but it does not warn users that using an API key over plaintext transport can expose the key and flight query data to interception or modification by network attackers. Because this skill is designed for real-time API use, the omission can lead users to adopt an insecure configuration in normal operation.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

This is a real external transmission of user-supplied flight data and an API credential to a third-party service. External transmission is expected for a flight-tracking skill, but using a plaintext HTTP URL makes that transmission unsafe and increases the security significance of the data flow.

Content

Scanner excerpt · scripts/track_flight.py (reported line 34)May include surrounding context.

python
def fetch_flight_data(flight_number: str, api_key: str) -> dict:
    """Fetch flight data from AviationStack API"""
    base_url = "http://api.aviationstack.com/v1/flights"
    
    params = {
        'access_key': api_key,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The code sends both the user's flight lookup and the API credential to an unsecured HTTP endpoint without any warning or consent mechanism. This enables passive eavesdropping and active manipulation of responses, which is especially risky in an agent skill that may run on shared or untrusted networks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.