ClawHub
Back to skill

Security audit

planesnitch

Security checks for vulnerabilities and agentic risk

Overview

This skill is a clearly disclosed aircraft-alerting Docker workflow that sends configured location and aircraft data to user-selected ADS-B, Telegram, or webhook services.

Before installing, review the Docker image and any downloaded config or CSV files, keep config.yaml private, mount it read-only where possible, and only configure Telegram chats or webhook URLs you control or trust because alerts include location and aircraft tracking data.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Transmission

Medium
Category
Data Exfiltration
Content
## Telegram Bot Setup

1. Message [@BotFather](https://t.me/BotFather), send `/newbot`, get a token — that's `bot_token`.
2. **Personal alerts:** send your bot a message first, then check `https://api.telegram.org/bot<TOKEN>/getUpdates` — your `chat_id` is in there.
3. **Channel alerts:** add the bot as admin on the channel, post something, then check `getUpdates` for the channel ID (starts with `-100`).

Multiple Telegram notification targets can use the same `bot_token` with different `chat_id`s to route different alerts to different chats/channels.
Confidence
15% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.