Security audit
Security checks for vulnerabilities and agentic risk
This flight-query skill is mostly purpose-aligned, but it runs an unpinned external MCP package and gives that subprocess the full local environment.
Review this before installing if your environment contains sensitive variables such as cloud keys, tokens, or internal service credentials. Prefer running it in a constrained environment, pinning or pre-approving the VariFlight MCP package version, and passing only the required VariFlight API key to the subprocess.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
自2026年3月18日起，Basic Auth（用户名/密码）已完全废弃，现在必须使用 OAuth2 客户端凭证流：
# Step 1: 在 opensky-network.org 注册账号，创建 API 客户端，下载 credentials.json
# Step 2: 获取 Access Token（有效期30分钟）
curl -X POST \
"https://auth.opensky-network.org/auth/realms/opensky-network/protocol/openid-connect/token" \
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# Step 1: 在 opensky-network.org 注册账号，创建 API 客户端，下载 credentials.json
# Step 2: 获取 Access Token（有效期30分钟）
curl -X POST \
"https://auth.opensky-network.org/auth/realms/opensky-network/protocol/openid-connect/token" \
-H "Content-Type: application/x-www-form-urlencoded" \
The skill description is written entirely in Chinese and does not indicate that other languages are supported or that the language choice is intentional and limited to a region-specific audience. Per the policy, forcing a specific language without user opt-in is a natural-language policy concern.
Without declared permissions the skill's intent is opaque and cannot be validated.
The natural-language content of the skill description, requirements, commands, troubleshooting, and labels is entirely Chinese, and the file does not indicate that this is a China-specific or Chinese-language-only skill. Per the policy criteria, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.
Using npx -y @variflight-ai/variflight-mcp without pinning an exact version allows whatever package version is current at execution time to be downloaded and run. If the upstream package is compromised, hijacked, or updated with malicious code, users of the skill could execute unreviewed code with network, file-read, and env-read access, including access to the API key.
This code performs a network-backed flight search and then prints the complete returned payload with JSON.stringify. Although it is labeled as debug mode, there is no explicit warning that potentially sensitive or account-linked response data may be exposed in console output.
uvx/uv tool run commands without ==version create a rug-pull risk.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
This markdown file contains concrete curl examples using client_id, client_secret, and bearer tokens to call external services. While the examples are technically explanatory, the surrounding text does not warn users that these values are sensitive credentials that must be protected and not logged, shared, or committed.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Step 1: 在 opensky-network.org 注册账号，创建 API 客户端，下载 credentials.json
# Step 2: 获取 Access Token（有效期30分钟）
curl -X POST \
"https://auth.opensky-network.org/auth/realms/opensky-network/protocol/openid-connect/token" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=client_credentials" \
This file mixes English scaffolding with Chinese-only command descriptions and API-key guidance, which effectively forces a specific language for core usage instructions. The policy forbids locale-specific behavior unless the skill offers user choice or clearly documents a justified regional constraint.
The command prints all user-facing status and result messages in Chinese, including the main status line, errors, and field labels. This imposes a specific language on all users without opt-in or any visible justification, which matches the language/locale policy violation criteria.
This code emits all user-facing messages in Chinese, including usage help, status messages, and flight details labels. The file does not provide any user opt-in, locale selection, or documented justification that the skill is intentionally limited to Chinese-speaking users, which fits the language/locale policy violation category.
The command's user-facing strings throughout the file are written in Chinese, including status messages, errors, and usage output. This imposes a specific language on users without opt-in or indication that the skill is intentionally region-specific, which matches the locale-policy violation criteria.
This code presents user-facing output in Chinese, including examples and usage guidance, but does not indicate that the skill is Chinese-only or provide any user opt-in for language selection. That creates a natural-language locale policy concern because the skill effectively forces a specific language in its interface.
This file’s comments, prompts, errors, and weather labels are presented in Chinese throughout, including output strings shown directly to the user. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.
The code resolves and executes npx, then launches @variflight-ai/variflight-mcp without pinning an exact package version. This makes execution dependent on whatever version is current or otherwise resolved at runtime, increasing supply-chain risk and enabling unexpected or malicious code execution if the package, dependency tree, or resolution source is compromised.
The subprocess environment is built from ...process.env, so the spawned MCP server inherits all parent environment variables, which may include API keys, tokens, cloud credentials, and internal configuration secrets. Because the child process is an externally launched package, any compromise, telemetry, crash reporting, or malicious behavior in that package could expose sensitive credentials.
The code automatically launches an external package via npx with no user-facing disclosure or consent step. In this skill context, that means runtime code is fetched or executed outside the reviewed codebase, which materially raises the risk of hidden network activity, supply-chain compromise, and execution of unreviewed code on the host.
This code reads sensitive credentials from config.local.json and environment variables, then injects the key into the environment for an npx-launched subprocess. While the code has internal comments, there is no user-facing prompt, log, or disclosure warning about credential use or subprocess propagation in this file.
The script's console messages and guidance are written entirely in Chinese, which imposes a specific language on users without any opt-in or fallback. Under the policy for natural-language violations, forcing a specific language without user choice is in scope even in code string literals.
The skill sends user-supplied flight numbers, routes, dates, airport selections, and potentially real-time tracking queries to an external third-party service, but the description does not clearly warn users about that data flow. This can lead to unintended disclosure of sensitive travel information, especially for business, VIP, or personal itineraries where route and timing data may be privacy-sensitive.
The only natural-language instruction/comment in the file is written in Chinese, which imposes a specific language context on maintainers or users without any opt-in or documented rationale. Under the stated policy, fixed language usage can be a locale/language policy issue when no choice or justification is provided.
The script invokes an external tool client to retrieve flight schedule data, which implies a network/API request, but the file provides no user-facing notice, confirmation, or explanatory comment about this outbound call. Aside from a terse internal test comment, there is no disclosure of the external request behavior in the script itself.
Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal