ClawHub
Back to skill

Security audit

Flight Price Monitor

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed flight-price monitoring skill that uses a third-party flight-search CLI, optional scheduled checks, and local price-history files.

Install this only if you want FlyAI/Fliggy-based fare lookup or monitoring. Verify the npm package source, use a limited API key if you configure one, set reasonable monitoring frequency and stop conditions, and know how to remove scheduled tasks and delete the local price-history files when done.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The manifest description is broad enough to route generic flight-search and airfare-shopping requests into this skill, even when the user did not ask for monitoring. That creates overreach risk: the skill may collect trip details, create history files, or encourage recurring monitoring behavior in contexts where a narrower search skill would be more appropriate.

Vague Triggers

Medium
Confidence
95% confidence
Finding
Several regex patterns match routine travel-shopping queries such as checking ticket prices, round-trip fares, or asking which skill to use, not just persistent monitoring use cases. In an agent ecosystem, this can cause inappropriate skill activation and unintended side effects like writing to memory, setting up scheduled tasks, or steering users into a China/Fliggy-specific workflow they did not request.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.