Aviationstack Cli

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:32 AM UTC
• Version: 0.1.0

Overview

The skill has a coherent AviationStack CLI purpose, but its setup asks agents to run mutable internet installers and link a local command, so it should be reviewed before installation.

Install only if you are comfortable with the setup executing mutable third-party code and modifying your local command environment. Prefer reviewing and pinning the referenced tools, running setup in an isolated environment, and treating the AviationStack token as a secret that may be stored and used for outbound API calls.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:18

Finding

Unverified Remote Installer Executed Directly by Bash

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 18
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

bash

bun --version || curl -fsSL https://bun.sh/install | bash

Technical Analysis

If Bun is unavailable, this command downloads the current response from https://bun.sh/install and immediately executes it with Bash. The retrieved script is not pinned to a version and is not validated with a checksum or cryptographic signature before execution.

HTTPS provides transport protection but does not guarantee that the endpoint, hosting infrastructure, DNS resolution, or upstream release process cannot be compromised. Because the downloaded content is never stored for inspection, the effective payload can change after the Skill has been reviewed.

Installing Bun may be relevant to building the CLI, but direct execution of an unverified remote script is not the minimum-risk method necessary to provide the Skill's flight-information functionality.

Attack Path

1. A user or agent follows the setup instructions on a system where bun is not installed.
2. The bun --version command fails, causing the shell to evaluate the command after ||.
3. curl retrieves the current payload from https://bun.sh/install.
4. The response is passed directly to Bash without integrity or authenticity verification.
5. If the remote source or delivery chain has been compromised, attacker-controlled commands execute with the privileges of the invoking user.
6. Those commands can access user-readable data, alter files and shell configuration, install additional software, or retrieve and execute further payloads.

Impact Assessment

Successful exploitation provides arbitrary command execution under the account running the installation. The payload can read or modify any files available to that account, access environment variables and locally available credentia ...[truncated 297 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the curl | bash installation pattern.
• Prefer a trusted operating-system package manager or another installation channel that supports immutable versions and integrity verification.
• Pin Bun to a specific reviewed version rather than installing the latest mutable release.
• If a standalone installer is required, download it as a separate file, verify its published cryptographic checksum or signature, and present it for review before execution.
• Require explicit user approval before installing runtime dependencies or modifying the environment.
• Document the files and shell configuration that the installer is expected to modify.
• Where practical, run the build in an isolated container or sandbox with no access to unrelated credentials or user files.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:12

Finding

Unpinned Third-Party Package and GitHub Source Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12–20
Vulnerability Type: Insecure third-party dependency resolution
Risk Level: High

Vulnerable Code:

bash

npx api2cli install Melvynx/aviationstack-cli

bash

bun --version || curl -fsSL https://bun.sh/install | bash
npx api2cli bundle aviationstack
npx api2cli link aviationstack

Technical Analysis

The setup invokes api2cli through npx without an exact package version or integrity constraint. Depending on the local environment and npm resolution behavior, npx can retrieve and execute the currently published package. The instructions also identify the GitHub repository Melvynx/aviationstack-cli without pinning installation to a reviewed commit or immutable release artifact.

Consequently, the code executed during installation, bundling, and linking may differ from the code that existed when the Skill was audited. A compromised npm release, package maintainer account, GitHub repository, or upstream dependency can introduce attacker-controlled installation or build behavior. The audited project contains only SKILL.md, so it provides no local implementation against which the downloaded CLI can be verified.

The linking operation also changes the user's command environment by making the resulting CLI available through ~/.local/bin. Although this supports the declared setup process, it increases the consequences of an upstream compromise because the generated executable can subsequently be invoked as a trusted command.

Attack Path

1. A user or agent follows the documented installation or build procedure.
2. npx resolves the mutable api2cli package name without an exact version or recorded integrity value.
3. The resolved package executes with the invoking user's privileges.
4. The installation workflow retrieves code associated with the unpinned GitHub repository or otherwise processes mutable upstream content. ...[truncated 951 chars]

Remediation

View remediation

Remediation Suggestions

• Pin api2cli to an exact, reviewed version instead of invoking an unconstrained package name.
• Use a lockfile and verify npm integrity metadata where the installation workflow permits it.
• Pin the GitHub source to a reviewed commit hash or immutable signed release rather than a mutable repository reference.
• Publish and verify cryptographic checksums or signatures for the expected CLI artifacts.
• Disable or carefully review dependency lifecycle scripts before allowing package installation in a sensitive environment.
• Separate package retrieval from execution so that downloaded source and generated artifacts can be inspected first.
• Require explicit user approval before linking executables or modifying PATH.
• Build and test the CLI in an isolated, least-privileged environment without access to unrelated API tokens, SSH keys, or developer credentials.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The skill pipes a remote script from https://bun.sh/install directly into bash, which executes code from the network without prior verification. In a skill setup path, this is especially dangerous because it grants immediate code execution on the host and could be abused through upstream compromise, MITM in weaker environments, or malicious content changes.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

If aviationstack-cli is not found, install and build it:

bash

bun --version || curl -fsSL https://bun.sh/install | bash
npx api2cli bundle aviationstack
npx api2cli link aviationstack

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The | bash construct is a classic command-chaining pattern that turns untrusted network content into immediate shell execution. Within this skill, the context makes it more dangerous because the command is presented as a normal prerequisite step, increasing the chance an agent or user executes it without review.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

If aviationstack-cli is not found, install and build it:

bash

bun --version || curl -fsSL https://bun.sh/install | bash
npx api2cli bundle aviationstack
npx api2cli link aviationstack

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest description says to use the skill when the user mentions 'flight search', 'airport lookup', or 'airline search'. These phrases are fairly generic and may overlap with ordinary travel-related requests, making the activation boundary unclear without stronger context or exclusions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs use of npx api2cli install Melvynx/aviationstack-cli without pinning an exact package/version or commit, so future executions may pull changed code from the registry or referenced source. In an agent skill context, this creates a supply-chain risk because installation happens automatically from remote infrastructure before the tool is trusted.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

npx api2cli bundle aviationstack invokes an unpinned remote toolchain, meaning the behavior and downloaded code can change over time without review. Because this is part of setup, compromise of the package or upstream dependency could lead to arbitrary code execution on the host.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

npx api2cli link aviationstack again relies on an unpinned tool version during a step that modifies the local environment and PATH-related tooling. If the upstream package changes or is compromised, the skill could install or link a malicious executable for later use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The authentication section tells the user to store an API token and test it, but it does not warn that the token will be retained by the CLI and used for outbound network requests to a third-party service. In an agent environment, missing consent and handling guidance increases the risk of inadvertent credential exposure or use in an unexpected context.

Content

No source excerpt is available for this finding.