ClawHub
Back to skill

Security audit

A simple Flight Tracker

Security checks for vulnerabilities and agentic risk

Overview

This flight skill mostly does what it says, but its schedule lookup can send an AviationStack API key over unencrypted HTTP.

Review before installing. The skill does not show signs of persistence or destructive behavior, but do not use it with a real AviationStack key unless the endpoint is changed to HTTPS and the key handling is tightened. Expect it to contact OpenSky Network and AviationStack when invoked.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/schedule.py:41
Finding

API Credential Transmitted over Unencrypted HTTP

Content
View full analysis

Vulnerability Details

File Location: scripts/schedule.py, lines 41–49
Vulnerability Type: Plaintext transmission of sensitive information
Risk Level: High

Vulnerable Code

python
base_url = "http://api.aviationstack.com/v1/flights"

params = {
    'access_key': api_key,
    'dep_iata': origin,
    'arr_iata': dest,
}

if date:
    params['flight_date'] = date

url = f"{base_url}?{urllib.parse.urlencode(params)}"

try:
    with urllib.request.urlopen(url, timeout=10) as response:
        data = json.loads(response.read())
        return data

Technical Analysis

The schedule lookup embeds the value of AVIATIONSTACK_API_KEY in the URL query string and sends the request to an http:// endpoint. Because HTTP provides neither transport encryption nor server authentication, the API key, origin and destination airport codes, optional travel date, and returned schedule information can be observed or modified in transit.

Query-string credentials may additionally be retained by intermediary proxy logs, monitoring systems, or other URL-recording infrastructure. Although contacting AviationStack is necessary for the declared schedule-search functionality, transmitting its credential over plaintext HTTP is not necessary and violates secure least-privilege handling of sensitive information.

Attack Path

  1. A user configures AVIATIONSTACK_API_KEY and invokes scripts/schedule.py.
  2. The script appends the key to the access_key query parameter.
  3. It sends the resulting URL to api.aviationstack.com over unencrypted HTTP.
  4. An attacker positioned on the local network, an untrusted Wi-Fi network, a compromised gateway, or an intermediary proxy captures the request.
  5. The attacker extracts and reuses the API key, or alters the API response before it reaches the script.

Impact Assessment

A network-positioned attacker can obtain the AviationStack API credentia ...[truncated 429 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace the endpoint with https://api.aviationstack.com/v1/flights and retain normal TLS certificate and hostname verification.
  2. If AviationStack supports credential-bearing authorization headers, use one instead of placing the key in the query string.
  3. Avoid printing, logging, persisting, or including the complete credential-bearing URL in exception and diagnostic output.
  4. Validate that redirects cannot downgrade the request from HTTPS to HTTP or forward credentials to an unexpected host.
  5. Rotate any API key previously used with the plaintext endpoint, because it may already have been exposed.
  6. Add an automated test or static-analysis rule that rejects plaintext HTTP endpoints used for credentials or other sensitive data.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description covers two major capabilities: live flight tracking via OpenSky Network and flight schedule search. This code chunk implements only the schedule-search portion. It queries AviationStack for scheduled flights between two airports and formats the results; without an API key, it only prints external search links. There is no code for querying OpenSky Network, no real-time flight state retrieval, and no support for tracking flights by region, callsign, or airport. Therefore the description materially overstates what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The code substantially matches the live flight-tracking portion of the description: it uses OpenSky Network and supports querying live flights in predefined regions, filtering by callsign, and tracking by ICAO24. However, the declared description also claims flight scheduling and searching schedules between airports, including examples like arrival times from Hamburg to Zurich. Nothing in the code accesses any schedule API or implements route/airport schedule lookup. Additionally, airport search is not generally supported; only a few hardcoded named bounding boxes are available. Therefore the description overstates the implemented functionality in a material way.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The code sends the AviationStack access key and query parameters over plain HTTP, which allows network attackers to intercept or modify the request in transit. This can expose the API credential, leak user query data, and enable tampering with returned flight information.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill documents commands that use network access and environment variables (for the optional API key) but does not declare any tool scope such as allowed-tools or permissions. This creates an authorization and transparency gap: a user or host system cannot easily tell that the skill expects outbound HTTP access and secret-bearing environment access, which can lead to over-privileged execution or unintended data exposure.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

This script transmits data to an external service, including an API key and user-supplied route/date information. External transmission is expected for this skill's purpose, but here it becomes security-relevant because the destination is plain HTTP, which makes the transmission observable and modifiable by intermediaries.

Content

Scanner excerpt · scripts/schedule.py (reported line 46)May include surrounding context.

python
def get_aviationstack_schedule(origin, dest, api_key, date=None):
    """Query AviationStack API for flight schedules (requires API key)"""
    base_url = "http://api.aviationstack.com/v1/flights"
    
    params = {
        'access_key': api_key,

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The manifest describes a flight tracking and scheduling skill, but this file additionally depends on reading a local environment secret via AVIATIONSTACK_API_KEY. Accessing host environment configuration is not mentioned in the stated scope and is not an obvious user-facing capability of answering flight schedule queries.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.