Aerobase Flight Awards

PassAudited by ClawScan on May 1, 2026.

Overview

This is a coherent Aerobase API skill for award-flight searches, but it uses an Aerobase API key and can manage saved route alerts.

Before installing, make sure you are comfortable giving the agent an Aerobase API key and sending travel search details to aerobase.app. Ask the agent to confirm before it creates, changes, or deletes saved award alerts.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

Anyone using the skill must trust the agent environment with an Aerobase API key tied to their account or quota.

Why it was flagged

The skill needs an Aerobase API key and uses it as a bearer token for API access. This is expected for the service, and the instructions also say not to print raw keys.

Skill content

Required env var: `AEROBASE_API_KEY` ... Auth header (preferred): `Authorization: Bearer ${AEROBASE_API_KEY}`

Recommendation

Use a dedicated Aerobase key if available, avoid sharing it in chat, and rotate it if it is exposed.

Low

#ASI02: Tool Misuse and Exploitation

What this means

The agent could create, change, or delete saved travel alerts on the Aerobase account if asked or if it interprets a request that way.

Why it was flagged

The documented API includes account-affecting alert-management operations, not just read-only search.

Skill content

POST /api/awards/alerts — create alert ... PATCH /api/awards/alerts/{id} — activate/deactivate alert ... DELETE /api/awards/alerts/{id} — remove alert.

Recommendation

Confirm the route, date range, and alert action before creating, disabling, or deleting alerts.