Seats Aero
PassAudited by ClawScan on May 1, 2026.
Overview
This appears to be a benign flight-award search helper, but users should treat the Seats.aero API key like a password because the skill asks to keep it in chat context.
This skill is purpose-aligned for searching award flight availability and does not show destructive behavior. Before installing, be comfortable sharing a Seats.aero API key with the agent, avoid storing that key beyond the active task, and do not rely on the referenced Python helper unless it is provided and reviewed separately.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
You must provide a Seats.aero API key for the skill to work, so the agent will be able to use that key for Seats.aero API requests.
The skill requires a third-party API credential. This is purpose-aligned for the seats.aero API, but users should notice that the registry metadata does not declare a primary credential.
Before searching, you need a seats.aero API key... All requests require the header: `Partner-Authorization: Bearer {api_key}`Use a dedicated, revocable API key if possible, do not provide unrelated credentials, and revoke the key if you no longer trust the conversation or agent.
The API key could be reused during the conversation and may be visible wherever conversation context is stored or reviewed.
The skill tells the agent to keep the API key in chat context. This appears intended for convenience within the workflow, but it means the credential may remain available later in the conversation.
Store the key in conversation context for subsequent requests
Avoid saving the key to long-term memory, ask before reusing it in a new context, and clear or rotate the key when the task is finished if needed.
The referenced helper code is not available for review in these artifacts and may simply be missing or unusable.
SKILL.md references a helper implementation, but the provided manifest contains only SKILL.md. No automatic download or execution is instructed, so this is a packaging/provenance note rather than a security concern.
For complex or repeated searches, use the Python helper: `from scripts.seats_api import search_availability, format_results`
Prefer direct API calls described in SKILL.md unless the helper file is supplied from a trusted source and reviewed before use.