ADS-B Overhead

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:51 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent aircraft-overhead alert helper, with disclosed cron, local state, WhatsApp notification, and optional photo lookup behavior.

Before installing, confirm the ADS-B feed host, home coordinates, WhatsApp target, and cron interval are yours. Disable photo lookup if you do not want aircraft hex identifiers sent to Planespotters or thumbnails stored locally, and review the ~/.clawdbot/adsb-overhead directory periodically for state, logs, and cached photos.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (10)

Session Persistence

Medium

• Category: Rogue Agent

Content

1) Copy the example config and edit it:

```bash
mkdir -p ~/.clawdbot/adsb-overhead
cp skills/public/adsb-overhead/config.example.json ~/.clawdbot/adsb-overhead/config.json
nano ~/.clawdbot/adsb-overhead/config.json
chmod 600 ~/.clawdbot/adsb-overhead/config.json

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

mkdir -p ~/.clawdbot/adsb-overhead
cp skills/public/adsb-overhead/config.example.json ~/.clawdbot/adsb-overhead/config.json
nano ~/.clawdbot/adsb-overhead/config.json
chmod 600 ~/.clawdbot/adsb-overhead/config.json
```

2) Add a user crontab entry (runs every minute):

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill instructs execution of a Python script that uses shell execution, network access to a local TCP ADS-B feed, and persistent file writes, but the manifest does not declare any explicit tool scope or permission boundaries. In an agent environment, missing scope declarations can allow broader-than-intended tool access and make it harder to enforce least privilege or safely review what the skill is allowed to do.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

_expand(photo_cfg.get("dir") or str(Path.home() / ".clawdbot" / "adsb-overhead" / "photos")),
        ]

    p = subprocess.run(cmd, capture_output=True, text=True)
    if p.returncode != 0:
        raise RuntimeError(f"checker failed ({p.returncode}): {p.stderr.strip()}")

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

_expand(photo_cfg.get("dir") or str(Path.home() / ".clawdbot" / "adsb-overhead" / "photos")),
        ]

    p = subprocess.run(cmd, capture_output=True, text=True)
    if p.returncode != 0:
        raise RuntimeError(f"checker failed ({p.returncode}): {p.stderr.strip()}")

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill is presented as using a local ADS-B feed, but it optionally contacts third-party services to retrieve aircraft photos and embeds links to external tracking sites. This creates a privacy and data-flow discrepancy: queried ICAO hex identifiers and user activity may be exposed to external providers, which is especially sensitive for a local monitoring/notification workflow.

External Transmission

Medium

• Category: Data Exfiltration

Content

h = hex_.strip().upper()
    if not h:
        return None
    url = f"https://api.planespotters.net/pub/photos/hex/{h}"
    try:
        data = fetch_json(url, timeout_s=timeout_s)
        return _planespotters_pick_photo_url_sized(data, size=size)

• Confidence: 93% confidence
• Finding: This code transmits aircraft ICAO hex identifiers to api.planespotters.net, creating an external data disclosure path not necessary for core local-feed detection. In a local monitoring skill, this can leak monitored aircraft interest patterns and operational metadata to a third party whenever photo lookup is enabled.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The script can download and persist third-party images locally, which expands the skill's capabilities beyond simple local ADS-B monitoring. Even with basic allowlisting and size checks, this introduces unnecessary external content retrieval and storage, increasing privacy, supply-chain, and disk-consumption risk in a cron-executed automation context.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: The config sets "tz" to "Europe/London", which imposes a specific locale setting in natural-language/policy terms. In this file there is no accompanying indication that the timezone is user-selectable, optional, or justified as region-specific, so it may violate the requirement to avoid forcing a locale without user opt-in.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The save() function creates parent directories and writes the updated JSON config to disk, replacing the existing file contents. Although the module docstring mentions updating settings, there is no user-facing prompt, warning, or runtime disclosure before performing this file write.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: config.example.json:21