ClawHub
Back to skill

Security audit

Track Flight

Security checks for vulnerabilities and agentic risk

Overview

This flight-tracking skill does what it says, but it sends the AviationStack API key and flight lookup over unencrypted HTTP, so users should review the risk before installing.

Install only if you are comfortable sending flight numbers and the AviationStack API key to AviationStack over plain HTTP. Prefer an HTTPS-capable plan or another provider, use a limited/rotatable API key, avoid putting the key in shared shell profile files, and rotate any key already used through the HTTP endpoint.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/track_flight.py:34
Finding

API Credential Transmitted Over Plaintext HTTP

Content
View full analysis

Vulnerability Details

File Location: scripts/track_flight.py:34-43
Vulnerability Type: Plaintext transmission of sensitive credentials
Risk Level: High

Vulnerable Code

python
def fetch_flight_data(flight_number: str, api_key: str) -> dict:
    """Fetch flight data from AviationStack API"""
    base_url = "http://api.aviationstack.com/v1/flights"
    
    params = {
        'access_key': api_key,
        'flight_iata': flight_number.upper()
    }
    
    try:
        response = requests.get(base_url, params=params, timeout=10)

The insecure transport limitation is also disclosed in SKILL.md:104:

markdown
- Uses AviationStack free tier (no HTTPS on free plan)

It is repeated in references/api-setup.md:41-44:

markdown
**Free Tier:**
- 100 requests/month
- Real-time flight data
- Historical flights
- Airport/airline lookup
- HTTP only (no HTTPS)

Technical Analysis

The script places the AviationStack API key in the access_key query parameter and submits the request over unencrypted HTTP. The requested flight number is transmitted in the same manner.

Because HTTP provides neither transport confidentiality nor server authentication, any party capable of observing or controlling the network path may read the complete request URL. Query strings are also commonly recorded by proxies, gateways, monitoring systems, and server access logs, increasing the number of places where the credential may persist.

An active network attacker can modify the unprotected response as well. Although this does not directly grant local code execution, it can cause the Skill to present forged flight statuses, gates, times, or live-position data.

Calling an external flight-data service is necessary for the declared functionality, and reading the dedicated API-key environment variable is appropriately scoped. Sending that credential through plaintext HTTP, however, ...[truncated 1334 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace the endpoint with an HTTPS URL and fail closed if TLS is unavailable:
    python
    base_url = "https://api.aviationstack.com/v1/flights"
  2. Do not support an API plan that requires credentials to be transmitted over plaintext HTTP. Require an HTTPS-capable AviationStack plan or select an alternative flight-data provider that supports TLS.
  3. Where supported by the provider, move credentials from the query string to an authorization header to reduce exposure through URL logging:
    python
    headers = {"Authorization": f"Bearer {api_key}"}
response = requests.get(base_url, headers=headers, params={
    "flight_iata": flight_number.upper()
}, timeout=10)
  4. Keep TLS certificate verification enabled and do not add verify=False.
  5. Update SKILL.md and references/api-setup.md so they do not direct users toward plaintext credential transmission.
  6. Rotate any API key that has already been used through the HTTP endpoint.
  7. Avoid including complete request URLs or query parameters in error logs, because they may contain the key.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:30
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:30-33
Additional Location: references/api-setup.md:35-40
Vulnerability Type: Unpinned dependency installation from a live package index
Risk Level: Medium

Vulnerable Code

SKILL.md:30-33 instructs users to install an unconstrained package:

markdown
3. **Install dependencies:**
   ```bash
   pip3 install requests
   ```

The instruction is repeated in references/api-setup.md:35-40:

markdown
### 3. Install Python Dependencies

The script requires the `requests` library:

```bash
pip3 install requests
text

### Technical Analysis

The installation command resolves the latest version of `requests` and its transitive dependencies from the package index at installation time. The project provides no exact version constraint, lock file, artifact hash, or reviewed dependency set.

The package name is correctly spelled and refers to an established dependency, so there is no evidence of deliberate typosquatting or a currently malicious package. The risk arises from non-reproducible dependency resolution and trust in whatever package artifacts are available when setup occurs.

Installing without an isolated virtual environment may also modify the user's global Python environment or create dependency conflicts. Dependency code is subsequently loaded into the tracking process by the top-level `import requests` statement.

### Attack Path

1. A user follows the documented `pip3 install requests` command.
2. `pip` contacts its configured package index and resolves the package and transitive dependencies available at that time.
3. If a package-maintainer account, distribution artifact, configured mirror, or relevant supply-chain component has been compromised, the unconstrained command may retrieve an affected release.
4. Malicious code may execute during package installation or when `track_flight.py` imports the installed pack
...[truncated 829 chars]
Remediation
View remediation

Remediation Suggestions

  1. Add a reviewed dependency file with exact versions rather than resolving an unconstrained latest release:
    text
    requests==2.32.3
  2. Lock all transitive dependencies using a reproducible dependency-management process.
  3. Record and verify package hashes, then install with hash enforcement:
    bash
    python3 -m pip install --require-hashes -r requirements.txt
  4. Review the selected versions for known vulnerabilities and update them through a controlled dependency-review process.
  5. Direct users to create and activate an isolated virtual environment:
    bash
    python3 -m venv .venv
. .venv/bin/activate
python3 -m pip install --require-hashes -r requirements.txt
  6. Avoid global or privileged package installation and document the expected package index if a trusted internal mirror is required.
  7. Keep SKILL.md and references/api-setup.md synchronized with the pinned installation procedure.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Tainted flow: 'params' from os.environ.get (line 36, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
99% confidence
Finding

The API key is sourced from an environment variable and sent as a query parameter to an HTTP endpoint, so it can be exposed in cleartext over the network and in intermediary logs. The tainted-flow aspect alone is not inherently malicious, but in this context it becomes a real vulnerability because the credential is transmitted insecurely to an external service.

Content

Scanner excerpt · scripts/track_flight.py (reported line 42)May include surrounding context.

python
}
    
    try:
        response = requests.get(base_url, params=params, timeout=10)
        response.raise_for_status()
        return response.json()
    except requests.exceptions.RequestException as e:

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documentation states that the free AviationStack plan uses no HTTPS, meaning flight queries and API credentials may be transmitted over plaintext transport. This is dangerous because attackers on the network path could intercept or modify requests and responses, exposing API keys, user query data, and potentially tampered flight information.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The document states that the free tier is HTTP-only but does not warn that API requests, including the API key, may be transmitted without transport encryption. In the context of a flight-tracking skill that makes live API calls, this can expose credentials and query data to interception or modification by any attacker on the network path.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/track_flight.py (reported line 22)May include surrounding context.

python
def get_api_key() -> Optional[str]:
    """Get API key from environment variable"""
    api_key = os.environ.get('AVIATIONSTACK_API_KEY')
    if not api_key:
        print("Error: AVIATIONSTACK_API_KEY environment variable not set")

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The script uses plain HTTP for the AviationStack request while including the API key in the request, which exposes the key and associated flight queries to interception or modification by attackers on the network path. Because this is a flight-tracking skill that routinely sends external requests, the insecure transport is directly relevant and increases risk rather than being incidental.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill documents use of environment variables and outbound network access but does not declare any explicit tool scope or permissions boundaries. This is dangerous because an agent may invoke the skill with broader-than-expected capabilities, reducing transparency and making it harder to enforce least privilege or review what external access the skill requires.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill description encourages users to submit flight queries without clearly warning that those queries are sent to a third-party API service. This creates a privacy and data-handling risk because user-provided itinerary details or identifying travel information may be transmitted externally without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The setup instructions explicitly tell users to append the API key to a shell profile, which stores the credential in plaintext on disk and causes it to be automatically loaded into future shells. This increases exposure to local compromise, accidental disclosure through backups/dotfile sharing, and shoulder-surfing or screen-capture leaks when users follow the command verbatim.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/track_flight.py (reported line 34)May include surrounding context.

python
def fetch_flight_data(flight_number: str, api_key: str) -> dict:
    """Fetch flight data from AviationStack API"""
    base_url = "http://api.aviationstack.com/v1/flights"
    
    params = {
        'access_key': api_key,

Static analysis

No suspicious patterns detected.