ClawHub
Back to skill

Security audit

Flightmapify

Security checks for vulnerabilities and agentic risk

Overview

FlightMapify appears to be a real flight-search map skill, but it uses broad local server, credential, and process-control behavior that users should review before installing.

Install only if you are comfortable with this skill starting local background servers, using FlyAI credentials from environment variables or local config, and serving files from your OpenClaw workspace. Use a limited workspace and a dedicated FlyAI key, avoid important occupied ports, and manually stop any spawned servers after use.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (14)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
try:
            cmd = [sys.executable, "-m", "http.server", str(current_port)]
            # Ensure HTTP server runs from workspace directory (dynamic detection)
            http_process = subprocess.Popen(
                cmd,
                cwd=WORKSPACE_DIR,
                stdout=subprocess.DEVNULL,
Confidence
93% confidence
Finding
The script launches `python -m http.server` with `cwd=WORKSPACE_DIR`, which exposes the entire detected workspace over HTTP rather than only the generated flight map. In this skill context, the workspace may contain unrelated project files, prompts, configs, or secrets, so the server scope exceeds the claimed functionality and can leak sensitive local data.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
for pid in pids:
                if pid:
                    print(f"Killing process {pid} on port {port}...")
                    subprocess.run(['kill', '-9', pid], capture_output=True)
            return True
    except Exception as e:
        print(f"Error killing process on port {port}: {e}")
Confidence
98% confidence
Finding
This code forcefully executes `kill -9` against whatever PID `lsof` reports for the selected port, with no ownership check, confirmation, or allowlist. In practice, it can terminate unrelated local applications or developer services, causing denial of service and potential data loss if the killed process was writing state.

Lp3

Medium
Category
MCP Least Privilege
Confidence
97% confidence
Finding
The skill documentation describes capabilities that include reading environment variables, reading and writing files, invoking networked services, and using shell commands, yet no permissions are declared. That creates a trust and containment problem because users and the platform cannot accurately assess or restrict what the skill can do before installation or execution.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The stated purpose is flight search and route visualization, but the documented behavior includes spawning background servers, reading credentials from environment variables and user config files, loading a .env file, invoking external CLIs, and killing processes on occupied ports. This mismatch is dangerous because it hides privileged and potentially destructive behavior behind a benign travel-planning description, increasing the chance of over-trust and unintended credential or process impact.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The server reads a FlyAI API key from the process environment and from ~/.flyai/config.json, then reuses it for requests triggered through this skill. That behavior expands the skill's access to user secrets beyond what is obvious from a simple flight-search feature and can silently consume or expose a user's personal API credentials.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The skill intentionally kills any process occupying the requested HTTP port if a quick localhost probe does not look like its own server. That behavior is dangerous because it affects unrelated local services outside the flight-map feature boundary and can disrupt development tools, databases, or user applications.

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
By starting an HTTP server from the detected workspace root, the skill exposes far more content than necessary for rendering a flight map. Given the dynamic workspace detection logic, this may publish agent files, notes, source code, or credentials present in the workspace, increasing the risk of unintended local disclosure.

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
The code copies the full parent environment and then loads arbitrary key/value pairs from a local .env file into the child process. That broad secret propagation is more capability than needed for flight search and can expose API keys, tokens, or unrelated local secrets to the spawned server, especially if the child process is compromised or logs its environment.

Context-Inappropriate Capability

Medium
Confidence
76% confidence
Finding
The skill launches and detaches a local background server process, giving it persistent system-management behavior beyond simple flight lookup logic. In a skill context, this increases attack surface because the process may continue running, evade normal lifecycle controls, and interact with local resources in ways not obvious to the user.

Missing User Warnings

Low
Confidence
84% confidence
Finding
The README omits a clear warning that generated HTML is served over a local HTTP server on a configurable port. Even if bound to localhost, exposing content over HTTP changes the attack surface and can surprise users who may not realize a listening service is created.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The code silently loads and uses the user's FlyAI API key from environment/config with no user-facing consent or runtime disclosure. This creates a covert credential-use path where searches initiated through the skill are billed against or associated with the user's account without explicit authorization.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The HTTP endpoint accepts travel queries and forwards them to FlyAI through external subprocess calls, but the code provides no explicit notice that user-supplied itinerary data leaves the local service boundary. Travel searches can reveal sensitive behavioral information, so silent transmission to a third party is a meaningful privacy issue in this skill context.

Missing User Warnings

High
Confidence
99% confidence
Finding
The script force-kills a process on an occupied port without user consent or adequate warning. Even in a local-only setting, this is unsafe operational behavior because it can abruptly terminate unrelated services and lead to user confusion, downtime, or lost work.

Credential Access

High
Category
Privilege Escalation
Content
- ✅ Implemented OpenClaw skill configuration with user-configurable API Key
- ✅ Added automatic fallback to default FlyAI API Key when not configured
- ✅ Updated server manager to use Flask-based server
- ✅ Enhanced server management with .env file support
- ✅ Fixed API Key configuration issues (trial limit errors)
- ✅ Improved error handling and user feedback
- ✅ Removed flight-search-server-simple.py (now using Flask-based server exclusively)
Confidence
88% confidence
Finding
The skill documents support for loading credentials from environment variables, a .env file, and user config locations such as ~/.flyai/config.json. Accessing multiple credential stores increases the chance of over-collection, accidental disclosure, or use of secrets the user did not intend this skill to consume, especially when the behavior is not tightly permissioned and transparently declared.

Static analysis

No suspicious patterns detected.