Cabin Flights

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Concern

ASI02: Tool Misuse and Exploitation

What this means

If an agent with wallet capability follows this path too aggressively, it could send USDC to a booking deposit address and create an irreversible payment the user did not intend.

Why it was flagged

This is a high-impact crypto payment command, and the --yes flag can suppress an interactive confirmation; the skill does not clearly require explicit final user approval immediately before sending funds.

Skill content

node src/send.js base USDC <deposit_address> <amount_usdc> --yes --json

Recommendation

Require an explicit final user confirmation for the exact flight, passenger names, amount, chain, token, and deposit address; avoid --yes by default and use wallet spending limits.

Concern

ASI04: Agentic Supply Chain Vulnerabilities

What this means

The command may fail, run an unintended local script, or rely on an unreviewed external wallet skill when handling real funds.

Why it was flagged

The skill references local Node helper scripts for wallet balance and payment, but the provided package is instruction-only and does not include those src files, making the code provenance unclear for a funds-moving workflow.

Skill content

node src/balance.js base --json

# Send USDC to deposit address
node src/send.js base USDC <deposit_address> <amount_usdc> --yes --json

Recommendation

Declare and pin the wallet dependency or call a named, reviewed wallet tool instead of unqualified relative scripts; include clear provenance and user-approval requirements.

Note

ASI03: Identity and Privilege Abuse

What this means

Connecting a wallet gives the agent potential access to view balances and initiate payments for travel purchases.

Why it was flagged

The skill may use delegated wallet authority to inspect balances and send USDC; that is purpose-aligned for crypto flight payment, but it is sensitive account authority.

Skill content

If the agent has wallet capabilities (e.g., evm-wallet skill):
# Check USDC balance on Base
node src/balance.js base --json

# Send USDC to deposit address

Recommendation

Use a dedicated low-balance wallet, set spending limits where possible, and require manual approval for every payment.