The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides recipes for executing curl commands against a local API service at http://127.0.0.1:18890. These commands are designed to fetch flight data or update a local map UI.
[REMOTE_CODE_EXECUTION]: The automated scan flagged commands like curl ... | python3 as potential RCE. However, analysis shows these are functional recipes provided to the agent to process local API responses (e.g., filtering METAR data or extracting ICAO24 codes). Since the source is a local service under the skill's control and the scripts are transparent data filters, this is not a malicious execution vector.
[DATA_EXFILTRATION]: No exfiltration patterns were detected. The skill specifically includes hard rules prohibiting calls to upstream aviation services (FAA, OpenSky, etc.), mandating that all requests go through the local proxy to ensure compliance with egress policies.
[PROMPT_INJECTION]: The skill uses clear, instructional language for its 'Hard Rules' and 'Anti-Patterns' sections. These are standard operational constraints to ensure the agent uses the local API correctly and does not hallucinate network failures or invent data. There are no attempts to bypass safety filters or override the underlying agent's core identity.
[EXTERNAL_DOWNLOADS]: All network operations are directed to 127.0.0.1 (localhost). There are no downloads from untrusted external domains or unknown third-party repositories.

flight-tracking