Aerobase Jetlag

PassAudited by ClawScan on May 1, 2026.

Overview

This is a coherent API-only jetlag planning skill; the main things to notice are that it uses an Aerobase API key and may send travel and sleep-timing details to Aerobase.

This skill appears safe to install if you are comfortable using Aerobase's API. Keep the AEROBASE_API_KEY in the environment rather than in chat, avoid sharing unnecessary personal details, and note that the skill may suggest paid Aerobase tiers when quota limits are reached.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

The agent can make Aerobase API requests using the user's key, which may consume quota or paid plan allowance.

Why it was flagged

The skill requires a service API key and instructs the agent to use it for Aerobase API authorization. This is disclosed and purpose-aligned, with key-redaction guidance.

Skill content

Required env var: `AEROBASE_API_KEY`
- Auth header (preferred): `Authorization: Bearer ${AEROBASE_API_KEY}`
- Never print raw API keys in output; redact as `sk_live_***`.

Recommendation

Store the API key securely, do not paste it into chat, and rotate it if it is exposed.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Personal travel and sleep-timing details may be sent to Aerobase to generate recommendations.

Why it was flagged

The skill tells the agent to call an external provider and may include travel, sleep-window, and timezone context in those requests. This is expected for recovery planning and the endpoint is disclosed.

Skill content

Base URL: `https://aerobase.app` ... Use `/api/v1/recovery/plan` with their likely sleep window and timezone context.

Recommendation

Share only the travel and sleep details needed for the plan, and review Aerobase's privacy terms if the information is sensitive.