Security audit
planesnitch
Security checks across malware telemetry and agentic risk
Overview
The skill is a disclosed Docker-based aircraft alerting helper whose main risk is expected outbound sharing of configured locations and alert data with ADS-B sources, Telegram, or webhooks.
Before installing, decide whether you are comfortable sending your configured location coordinates and matching aircraft data to the ADS-B providers and notification targets you choose. Keep config.yaml private because it can contain Telegram bot tokens and webhook authorization headers, mount it read-only as documented, and only use webhook URLs and Docker images you trust.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
64/64 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.