Security audit

Variflight

Security checks for vulnerabilities and agentic risk

Overview

This travel-query skill is purpose-aligned, but it should be reviewed because it normalizes unsafe handling of a Variflight API key.

Before installing, prefer VARIFLIGHT_API_KEY from a trusted secret manager or protected environment. Avoid passing the key with --api-key, avoid project-level .variflight.json files, keep any local credential file outside repositories with restrictive permissions such as 600, and rotate the key if it was previously exposed in shell history, logs, or a shared file.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/variflight.py:98
Finding: API Key Exposure Through Command-Line Arguments
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: README.md:114
Finding: Plaintext Credential Files Created Without Restrictive Permissions
Content: View full analysis
~/.openclaw/workspace/.env.variflight ``` It also recommends another plaintext configuration file: ```bash echo '{"api_key": "sk-xxxx"}' > ~/.variflight.json ``` The application searches for and reads these credential files: ```python def find_config_file(): """Find config file in standard locations""" paths = [ './.variflight.json', # Project config os.path.expanduser('~/.variflight.json'), # User config os.path.expanduser('~/.config/variflight/config.json'), # XDG standard ] # Also check OpenClaw path for backward compatibility openclaw_path = os.path.expanduser('~/.openclaw/workspace/.env.variflight') if os.path.exists(openclaw_path): return openclaw_path for path in paths: if os.path.exists(path): return path return None ``` The API key is then loaded in plaintext: ```python config_path = find_config_file() if config_path: try: if config_path.endswith('.json'): with open(config_path) as f: config = json.load(f) if config.get('api_key'): return config['api_key'] elif config_path.endswith('.env.variflight'): # Legacy OpenClaw format with open(config_path) as f: for line in f: if '=' in line and not line.startswith('#'): key, val = line.strip().split('=', 1) if key == 'VARIFLIGHT_API_KEY': retur ...[truncated 2035 chars]
Remediation: View remediation
~/.variflight.json chmod 600 ~/.variflight.json ``` 2. Apply the same mode protection to `~/.openclaw/workspace/.env.variflight`. 3. Ensure parent configuration directories are private, preferably mode `0700`. 4. In `variflight.py`, inspect the selected file with `os.stat()` and reject or warn about files that are readable or writable by group or other users. 5. Prefer a platform secret manager, CI secret injection, or a narrowly scoped environment variable over persistent plaintext storage. 6. Add `.variflight.json` and `.env.variflight` patterns to relevant `.gitignore` guidance to reduce accidental repository disclosure. 7. Avoid project-level credential files where a repository is shared by multiple users. 8. Rotate any credential that was stored in a publicly accessible repository, archive, or locally readable file. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (11)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README explicitly shows passing the API key on the command line and storing it in plaintext JSON files. Command-line arguments can be exposed via shell history, process listings, CI logs, and screen sharing, while plaintext config files are easily leaked through backups, dotfile sync, or accidental commits. In a travel-query skill that relies on authenticated HTTP API access, this increases the risk of credential theft and unauthorized API use.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The client integration section repeatedly instructs users to write API keys into local environment/config files and shows literal secret values in examples without warning. Those patterns normalize insecure secret handling and can lead to leakage through repository commits, shared home directories, CI artifact capture, or misconfigured permissions. Because this skill is meant for broad use across OpenClaw, Claude Code, Cursor, GitHub Actions, and Docker, the insecure guidance is likely to be copied widely, increasing the attack surface.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill documents network access and use of environment/config-based secrets, but it does not declare an explicit tool scope such as permissions or allowed-tools. In an agent ecosystem, missing scope declarations can cause the runtime or user to grant broader capabilities than necessary, reducing transparency and weakening least-privilege controls.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation instructs users to store the API key in plaintext config files like ~/.variflight.json without warning about file permissions, secret managers, or accidental commits. Plaintext credential storage increases the chance of credential disclosure through local compromise, backups, dotfile syncing, or source control exposure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The examples pass the API key directly on the command line, which can leak secrets via shell history, process listings, CI logs, or telemetry collected by terminal tools. This is a well-known unsafe secret-handling practice, especially in shared systems and automated environments.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script explicitly supports passing an API key on the command line, which commonly exposes secrets through process listings, shell history, audit logs, and CI/job telemetry. In a travel-data skill, that key likely grants access to a paid upstream API, so disclosure can enable unauthorized API use, quota exhaustion, billing abuse, or service disruption.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 72% confidence
Finding: The skill documentation is predominantly Chinese, which may force a specific language experience on users without opt-in or an explicit note that the skill is intended for Chinese-speaking users. Under the stated policy, language constraints should either offer user choice or be clearly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: Natural-language content in the file switches between English and Chinese for key setup and usage instructions. Under the stated policy, forcing or assuming a specific language without opt-in can be a locale-policy issue when no choice or justification is provided.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script accepts a user-supplied API key and forwards it on the command line to another shell script without any warning or safer handling. Command-line arguments are commonly exposed via shell history, process listings, logs, and debugging output, so the credential may be unintentionally disclosed to other local users or operational tooling.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The script invokes another shell script and passes through the optional --api-key value, which is a sensitive credential flow. While the usage comment documents the parameter, there is no user-facing warning, confirmation, or disclosure about handling a credential when executing the command.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This Python file makes an HTTP POST request to an external Variflight endpoint using user-provided endpoint/params data and an API key in a request header. Although the function names imply API usage, the code lacks an inline warning, confirmation, or other user-facing disclosure near the network operation itself about transmitting request data to a remote service.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.