Aerobase Flight Deals

• Outcome: Pass
• Latest audit: May 29, 2026, 8:15 PM
• Version:
  3.2.1

Overview

This flight-deals skill is coherent and purpose-aligned, but users should understand that creating alerts may set up ongoing route monitoring through Aerobase.

Install only if you are comfortable giving the agent an Aerobase API key and letting it create route price-watch alerts on your Aerobase account. Confirm route, date, price, and alert criteria before creating watches, and periodically list or remove alerts you no longer need.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The skill’s invocation guidance is broad enough that an agent may use it for general travel shopping without clear boundaries on when alert creation or monitoring should occur. In practice, overly broad trigger conditions can cause unintended API calls, surprise side effects, or use of a persistent monitoring feature without sufficiently explicit user intent.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill exposes alert-creation endpoints but does not clearly warn at the point of use that creating an alert initiates ongoing monitoring behavior. That can lead to user surprise, unintended persistent tracking, and repeated background checks or notifications being set up without informed consent.

VirusTotal

65/65 vendors flagged this skill as clean.