ClawHub
Back to skill

Security audit

mcp-aviation-weather

Security checks across malware telemetry and agentic risk

Overview

This is a read-only aviation weather MCP server that sends requested station or coordinate lookups to an external weather API, with minor documentation/configuration mismatches to verify.

Reasonable to install if you want MCP-based aviation weather lookups. Confirm the npm package name and use NAUTDEV_BASE_URL if overriding the endpoint; expect station codes and coordinate searches to be sent to the configured external API, and do not treat responses as a substitute for official flight-safety sources.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
dist/index.js:7

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
src/index.ts:7