chase-travel
Warn
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/search_flights.pyallows for the execution of arbitrary shell commands through theCHASE_2FA_COMMANDenvironment variable usingsubprocess.runwithshell=True. While intended to automate 2FA code retrieval, this pattern allows for arbitrary command injection if the environment is manipulated. - [DYNAMIC_EXECUTION]: The 2FA hook mechanism uses
subprocess.runto execute a dynamically assembled command string from the environment at runtime, which is a high-risk execution pattern. - [CREDENTIALS_UNSAFE]: The
scripts/record_search.pyutility captures full network traffic, including POST data and request headers which may contain sensitive authentication tokens or credentials. This information is saved to a predictable and potentially world-readable location at/tmp/chase-network-capture.json. - [EXTERNAL_DOWNLOADS]: The skill requires the installation of
patchright(a Playwright fork) and its associated browser binaries. It also utilizes a custom Docker image hosted on the author's registry (ghcr.io/borski/chase-travel).
Audit Metadata