Google Flights CLI and MCP

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 3:42 AM UTC
• Version: 0.8.0

Overview

This skill is a straightforward guide for installing and using the Fli flight-search CLI and MCP server, with no hidden or destructive behavior in the artifact.

Install only if you trust the Fli package source and its dependencies. For higher-assurance environments, pin reviewed versions or install from an approved internal mirror; avoid running the install with sudo or administrator privileges.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:39

Finding

Unpinned Third-Party Packages Installed and Executed Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 39-43
Vulnerability Type: Unverified and unpinned third-party dependencies
Risk Level: Medium

bash

python3 -m pip install --user pipx
python3 -m pipx ensurepath
pipx install flights

Technical Analysis

The skill instructs users to install the latest available releases of the pipx and flights packages without pinning reviewed versions or verifying package hashes, signatures, publisher identity, or provenance. The effective code installed by these commands can therefore change after the skill has been audited.

Python package installation and subsequent invocation of installed entry points may execute package-controlled code with the privileges of the current user. If the package distribution, publisher account, release process, package index, or dependency chain is compromised, following these instructions could install and execute attacker-controlled code.

This finding does not establish that the named packages are currently malicious. The risk arises from the unrestricted trust placed in mutable third-party distributions.

Attack Path

1. An attacker compromises the package publisher, distribution account, release pipeline, package index, or a transitive dependency used by pipx or flights.
2. The attacker publishes a malicious release under a version accepted by the unpinned installation commands.
3. A user follows the skill and runs python3 -m pip install --user pipx or pipx install flights.
4. The package manager downloads the attacker-controlled release because no reviewed version or integrity hash is required.
5. Malicious package code executes during installation, dependency processing, or later invocation of fli, fli-mcp, or fli-mcp-http.
6. The payload operates with the installing user's privileges and can access resources available to that account.

Impact Assessment

Successful exploitation could allow ...[truncated 604 chars]

Remediation

View remediation

Remediation Suggestions

• Pin pipx and flights to versions that have been explicitly reviewed, for example by using exact == constraints.
• Publish and verify cryptographic hashes for approved artifacts. Where practical, install from a requirements or constraints file using hash enforcement such as pip --require-hashes.
• Document the authoritative package index, publisher identity, source repository, and release-signing or provenance information so users can detect dependency confusion or account impersonation.
• Review and lock transitive dependencies rather than validating only the top-level package.
• Recommend installation in an isolated, least-privileged environment and warn users not to run installation commands with sudo or an administrator account.
• Establish a controlled update process in which new versions are audited before the pinned version and expected hashes are changed.
• For higher-assurance deployments, use internally mirrored and approved artifacts rather than resolving mutable releases directly from a public package index.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep