ClawHub
Back to plugin

Security audit

Waltz Flight Assistant

Security checks across malware telemetry and agentic risk

Overview

The skill is a real flight-booking assistant, but it needs review because it runs automatically, sends booking context to a hosted backend, persists user/session state, and can resume a payment-related booking flow in the background.

Review this before installing if you are comfortable with a hosted travel service receiving your flight-search and booking conversation, a stable user ID, and any configured bearer token. Do not proceed with booking unless the itinerary, total price, merchant, and saved-card details are shown clearly and you explicitly approve the charge.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The plugin is configured with "onStartup": true, causing it to activate automatically without any user action or scoped trigger. For a tool that can contact a remote booking backend and potentially participate in transactional workflows, broad auto-activation increases the chance of unnecessary exposure, unintended invocation, and silent data flow to an external service.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The manifest explicitly advertises end-to-end flight booking and documents forwarding bearer tokens and stable user identifiers to a hosted backend, but it does not present a clear user-facing warning about external data transmission or real-world transactional side effects. In a travel-booking context, this is particularly sensitive because users may disclose personal itinerary details and could trigger booking-related actions without understanding what is sent off-platform.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
openclawId,
            contextId: session.contextId,
            message:
              "The user has completed Stripe card setup. Continue the active booking workflow now. If a saved card is available, confirm the exact total and ask for explicit approval to charge it. Do not ask the user to repeat traveler, route, or loyalty details already collected.",
          });
          const result = extractTaskText(task);
          const outboundText = result.text || "Your card is saved. Let's continue your booking.";
Confidence
87% confidence
Finding
After detecting completed card setup, the plugin automatically resumes the booking workflow and sends an instruction to continue toward charging the saved card. Although the message says to ask for explicit approval before charging, the system is autonomously advancing a purchase flow based on an external status change, which increases the risk of unintended booking progression, confused-deputy behavior, or a backend agent charging or reserving travel without a fresh user-triggered interaction.

Unpinned Dependencies

Low
Category
Supply Chain
Content
},
  "dependencies": {},
  "devDependencies": {
    "openclaw": "^2026.4.0"
  }
}
Confidence
90% confidence
Finding
The devDependency on `openclaw` is specified with a caret range (`^2026.4.0`), which allows newer minor/patch releases to be installed implicitly. While this is only a development dependency and not necessarily shipped at runtime, unpinned tooling can still undermine build reproducibility and may unexpectedly introduce vulnerable or malicious code during local builds or CI.

Known Vulnerable Dependency: openclaw==2026.4.0 — 10 advisory(ies): CVE-2026-53846 (OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency); CVE-2026-41913 (OpenClaw: Concurrent async auth attempts can bypass the intended shared-secret r); CVE-2026-53830 (OpenClaw: Slack and Zalo webhook secrets could remain active after secrets.reloa) +7 more

High
Category
Supply Chain
Confidence
97% confidence
Finding
The package uses `openclaw` version `^2026.4.0`, and static analysis indicates `2026.4.0` is associated with multiple published advisories, including issues involving secret handling, auth bypass, and environment/workspace influence. Even as a devDependency, this tool is invoked by build and installation workflows, so vulnerable behavior could affect developers, CI environments, published artifacts, or plugin installation paths.

VirusTotal

61/61 vendors flagged this plugin as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.