Aviation Agent

• Analyzed: May 15, 2026, 4:50 AM
• Findings: 1
• Version: 0.1.0
• Hash: 4b901ccecff88d9f04c07c2d38e4c68b79d85f35aa654452a1a5c57e7d741143
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is benign. The `SKILL.md` provides clear, non-malicious instructions for the AI agent to use the `scripts/metar.py` script and read local reference markdown files. The `scripts/metar.py` script safely fetches aviation weather data from `aviationweather.gov` using `urllib.request`, incorporating robust input validation (`validate_icao`) and a critical domain whitelist check (`ALLOWED_DOMAINS`) to prevent Server-Side Request Forgery (SSRF) and other network-based attacks. There is no evidence of data exfiltration, unauthorized command execution, persistence mechanisms, or prompt injection attempts against the agent to subvert its intended purpose.