Skiplagged Flights

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Installing the skill may require adding the mcporter CLI to your environment.

Why it was flagged

The skill depends on installing the mcporter Node package to provide the CLI used in all examples. This is aligned with the skill's MCP-calling purpose, but it is still a third-party executable dependency.

Skill content
node | package: mcporter | creates binaries: mcporter
Recommendation

Install mcporter from a trusted package source and keep it updated; review the package if your environment has strict supply-chain requirements.

What this means

Your flight or travel search details, such as routes and dates, are sent to Skiplagged's public MCP service.

Why it was flagged

The skill communicates with an external MCP server and sends travel-search parameters there. This is clearly disclosed and central to the flight-search purpose.

Skill content
Server URL: `https://mcp.skiplagged.com/mcp` ... Auth: none (public server)
Recommendation

Use the skill only for travel queries you are comfortable sharing with Skiplagged, and avoid entering unnecessary personal information.