ClawHub
Back to skill

Security audit

Dataify Google Flights

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Google Flights search integration that uses a Dataify API token and outbound API call, with some credential-handling cautions but no hidden or destructive behavior found.

Install only if you are comfortable sending flight-search details to Dataify and using a DATAIFY_API_TOKEN. Prefer a session-scoped environment variable for the token, do not paste real tokens into chat, and review requests that could consume extra credits such as deep search, cache bypass, high-volume, or multi-page searches.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill clearly relies on environment access, file reads, and outbound network use, yet no permissions are declared. That mismatch weakens reviewability and consent boundaries, because an agent or platform may execute capabilities the user or host did not explicitly approve. In this context the actions are aligned with the skill’s purpose, so the issue is not covert exfiltration, but it is still a real least-privilege and transparency problem.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger description is broad enough to match generic phrases like 'search flight prices/itineraries,' which can overlap with ordinary conversation and cause unintended skill activation. In an agent setting, over-broad activation can route user requests to an external scraping/API workflow without sufficiently explicit user intent, increasing privacy, cost, and policy risks.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The script prints all parsed/current request parameters directly to stdout in a markdown table, including values supplied via --params-json or arbitrary --key value arguments. Although it skips a field literally named Authorization when deriving documented fields, it does not prevent other sensitive parameters or unexpected secret-bearing keys from being displayed, which can leak credentials, PII, or session data into terminals, shell history, logs, or CI output.

Static analysis

No suspicious patterns detected.