ClawHub
Back to skill

Security audit

Planefilter

Security checks for vulnerabilities and agentic risk

Overview

PlaneFilter is a coherent flight-lookup skill that uses disclosed aviation APIs and API keys, with some install and credential-handling hygiene issues to consider.

Install from a reviewed or pinned source when possible, and only provide RAPIDAPI_KEY or AIRLABS_KEY if you are comfortable sending flight lookup requests to those aviation providers. The AirLabs key is placed in a URL query parameter, so avoid using a high-value shared key.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:12
Finding

Unpinned Remote Installer Execution and Mutable Source Installation

Content
View full analysis

Vulnerability Details

File Location: README.md, lines 12, 18, and 25
Vulnerability Type: Unpinned third-party installation sources
Risk Level: Medium

Complete Code Snippet

markdown
### Option 1: ClawHub (recommended)

```bash
npx clawhub install planefilter

Option 2: Git clone

bash
git clone https://github.com/ImL1s/planefilter-openclaw-skill.git ~/.openclaw/workspace/skills/planefilter

Option 3: Let the agent install it

Tell your OpenClaw agent:

"Install the planefilter skill from https://github.com/ImL1s/planefilter-openclaw-skill"

text

### Technical Analysis

The documented installation methods do not identify immutable, reviewed artifacts:

- `npx clawhub install planefilter` invokes an unpinned version of the `clawhub` package.
- The Git command clones the repository's mutable default branch without selecting a reviewed tag or commit.
- The agent-directed installation likewise references the mutable repository rather than a fixed revision.
- No checksum or signature verification is documented.

As a result, the code installed later may differ from the artifact reviewed during this audit. This creates a supply-chain trust gap: compromise of the relevant package publishing account, registry entry, repository, or maintainer account could cause users to install modified skill instructions or executable scripts.

### Attack Path

1. An attacker compromises an account or publishing channel associated with the unpinned npm package or GitHub repository.
2. The attacker publishes a malicious package version or modifies the repository's default branch.
3. A user or Agent follows one of the documented installation procedures.
4. The package manager or Git client retrieves the attacker's mutable version because no reviewed version, commit, checksum, or signature is required.
5. The modified files are installed into the OpenClaw skill directory.
6. The Agent loads the altered skill instructions or invokes its modifi
...[truncated 716 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the installation CLI to a reviewed version:

    bash
    npx clawhub@<reviewed-version> install planefilter

  2. Install the skill from a specific reviewed release tag or, preferably, an immutable commit:

    bash
    git clone https://github.com/ImL1s/planefilter-openclaw-skill.git ~/.openclaw/workspace/skills/planefilter
git -C ~/.openclaw/workspace/skills/planefilter checkout --detach <reviewed-commit-sha>

  3. Publish SHA-256 checksums or cryptographic signatures for released artifacts and require verification before the skill is activated.

  4. Protect package and repository publishing accounts with phishing-resistant multifactor authentication and restricted release permissions.

  5. Use reviewed, immutable release artifacts rather than directing an Agent to install from a mutable default branch.

  6. Document a controlled update procedure that requires review and integrity verification before moving to a new version.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The declared description says the skill is for end-user flight lookup tasks such as finding aircraft type and equipment changes for a flight number. However, this code chunk does not perform any flight-number lookup or aircraft/equipment analysis. Its primary function is operational: checking whether required API keys are present and whether upstream services are reachable. That is a materially different purpose from the declared user-facing lookup functionality. While health checks can be a supporting implementation detail, this specific chunk exposes undeclared resource access patterns (environment keys and connectivity tests to three services) and does not itself match the declared behavior, so this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md
`search_flight.js` outputs JSON to stdout:

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The README instructs users to run npx clawhub install planefilter without pinning a specific clawhub version. This causes execution of whatever package version is current at install time, which introduces supply-chain risk if the package is updated maliciously, compromised, or publishes breaking behavior. In this skill context, the command is explicitly presented as the recommended installation path, which makes the risk more significant because users are encouraged to execute it directly.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
85% confidence
Finding

The skill declares required environment variables and instructs execution of Node scripts, but it does not declare explicit tool scope or permissions for environment access. In agent platforms, missing permission declarations can cause hidden capability creep and make reviewers or users unaware that secrets such as API keys will be accessed.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger list contains broad phrases such as 'flight number' and 'what plane' that may match ordinary conversation and invoke the skill unexpectedly. Over-broad activation can expose API-backed behavior more often than intended, causing unnecessary external requests, privacy leakage of user queries, or user confusion about why the skill activated.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The security annotation states there are no network endpoints, but this module directly performs arbitrary HTTP and HTTPS requests to caller-supplied URLs. That mismatch can undermine review and policy enforcement, because a skill that appears non-networked can actually exfiltrate data or contact unapproved external services if other code passes attacker-controlled or sensitive destinations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The AirLabs API key is placed in the query string (?api_key=...) of a GET request. Query parameters are commonly recorded in logs, proxies, browser/history equivalents, monitoring systems, and upstream infrastructure, which increases the chance of credential exposure even when HTTPS is used. In a health-check script this is somewhat less dangerous because the key comes from environment variables and is not printed directly, but the aviation-skill context does not require URL-based secret transport, so the exposure is unnecessary.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.