OpenSky Flight Tracker

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:35 PM UTC
• Version:
  0.1.0

Overview

This is a straightforward flight-tracking skill with a disclosed third-party CLI install and no hidden privileged behavior in the artifacts.

Install only if you are comfortable adding the third-party PyPI package flight-tracker-cli. Queries may send flight numbers, callsigns, or coordinates to the flight-tracking data source, which is expected for this skill but may reveal location-related interests.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger text includes broad natural-language phrases such as "where is my flight" and "what's flying over me," which are common user utterances and can cause the skill to activate in loosely related contexts. Over-broad activation can lead to unintended tool use, unnecessary external requests, and incorrect routing of user queries, especially in agent systems that auto-select skills from descriptions.

VirusTotal

66/66 vendors flagged this skill as clean.