flight-skill

Pass

Audited by Gen Agent Trust Hub on Oct 10, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches flight and airport data from the FlightRadar24 public API (api.flightradar24.com). This is a well-known service used as the primary data source for the skill's functionality.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external API responses, which could theoretically contain instructions intended to influence the agent.
  • Ingestion points: Data is fetched in flight_skill.py via the fetch_json function and processed in cmd_status, cmd_trip, and cmd_airport.
  • Boundary markers: None are present in the script's output to the agent.
  • Capability inventory: The skill's script is limited to network reads and console output using the Python standard library; it has no file system write access or privilege escalation capabilities.
  • Sanitization: The script parses JSON data but does not perform specific sanitization for prompt injection patterns in the returned strings.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 10, 2026, 06:36 PM