Google Flights

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 7:28 PM UTC
• Version: 2.0.0

Overview

This flight-search skill is purpose-aligned and transparent about its local tracking files, but users should understand that it stores travel-related history and installs an unpinned third-party package.

Before installing, review the fast-flights dependency source and consider pinning a known version. Use price tracking only if you are comfortable storing routes, travel dates, alert thresholds, and price history under ~/clawd/memory, and delete those files when you no longer need tracking history.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:171

Finding

Unpinned Third-Party Dependency Allows Supply-Chain Code Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 171
Vulnerability Type: Unpinned third-party package installation
Risk Level: Medium

Vulnerable Code

bash

uv venv && source .venv/bin/activate && uv pip install fast-flights

Technical Analysis

The documented setup command installs fast-flights without an exact version constraint, cryptographic hash verification, or a committed dependency lockfile. As a result, installation resolves to whichever package release the configured package index serves at that time.

The package is imported directly by scripts/search.py:

python

from fast_flights import FlightData, Passengers, get_flights

Because Python executes package initialization code during import, a compromised or malicious future release could run arbitrary code whenever any of the flight-search scripts imports this dependency. The affected entry points include search.py directly and track.py and watch-route.py indirectly through their import of search.py.

This is a supply-chain weakness rather than evidence that the current fast-flights package is malicious.

Attack Path

1. An attacker compromises the upstream fast-flights package, its maintainer account, or the package publication channel.
2. The attacker publishes a malicious release under the legitimate package name.
3. A user follows the setup instructions and runs the unpinned installation command.
4. The package manager retrieves the attacker-controlled release because no reviewed version or hash is required.
5. The user invokes search.py, track.py, or watch-route.py.
6. Python imports fast_flights, causing malicious package initialization code to execute with the privileges of the user running the Skill.

Impact Assessment

Successful exploitation permits arbitrary code execution under the Agent user's account. The malicious dependency could read or modify files accessible to that account, including Skill configuration, flig ...[truncated 376 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin fast-flights to an exact, reviewed version instead of installing the latest available release:

   bash

   uv pip install "fast-flights==REVIEWED_VERSION"
   

2. Commit a lockfile that records all transitive dependency versions.

3. Require cryptographic hashes for downloaded distributions where supported.

4. Configure an explicit trusted package index rather than relying on ambient package-manager configuration.

5. Review dependency changes before updating the pin or regenerating the lockfile.

6. Add automated dependency vulnerability and integrity scanning to the release process.

7. Run the Skill in a least-privilege environment with restricted filesystem and network access to reduce the impact of a compromised dependency.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Most of the description matches the code: it searches flights, supports flexible dates, filters (nonstop, price cap, departure/arrival times), and connection scoring. However, the description claims 'price tracking with alerts,' while the code only performs point-in-time searches and includes a current price field in output; there is no persistence, monitoring loop, scheduling, or alerting mechanism. Additionally, the code reads a local config file for user preferences, which is an undeclared resource access. That access is related to flight search behavior, so it is less severe than the missing alert capability, but it is still an undeclared capability/resource use. Overall, this is a meaningful description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The code partially aligns with the declared description because it does monitor route prices and generate alerts for regular routes. However, its primary behavior in this chunk is narrower and materially different from a general flight-search skill: it is a local command-line watcher that maintains a persistent watchlist and checks a small set of future dates. The broader declared capabilities—general flight search, flexible date search, detailed filtering, connection quality scoring, and explicit Google Flights behavior—are not present in this code chunk. While some of those features may exist in imported modules, they are not evidenced here. Therefore the description overstates and mischaracterizes what this supplied code actually does.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence

Finding

The skill documentation advertises commands that read from and write to local files, but it does not declare any explicit tool scope or permissions. This creates an authorization and transparency gap: an agent could persist data or access local state without users or the platform having a clear policy boundary for those operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill persists tracked flights, watched routes, and price history in local files but does not clearly warn users about ongoing data retention. Even if the data seems low sensitivity, travel patterns and preferences can reveal personal habits, home airports, and future trip timing, which creates avoidable privacy risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This script persistently stores flight routes, travel dates, alert thresholds, and price history under the user's home directory without any explicit notice, consent flow, retention policy, or access controls. While not an exploit primitive by itself, it creates a privacy risk because travel history and future itineraries are sensitive personal data that could be exposed to other local users, backups, or downstream tooling that reads the same memory directory.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.