flight-skill
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches flight and airport data from the FlightRadar24 public API (api.flightradar24.com). This is a well-known service used as the primary data source for the skill's functionality.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external API responses, which could theoretically contain instructions intended to influence the agent.
- Ingestion points: Data is fetched in
flight_skill.pyvia thefetch_jsonfunction and processed incmd_status,cmd_trip, andcmd_airport. - Boundary markers: None are present in the script's output to the agent.
- Capability inventory: The skill's script is limited to network reads and console output using the Python standard library; it has no file system write access or privilege escalation capabilities.
- Sanitization: The script parses JSON data but does not perform specific sanitization for prompt injection patterns in the returned strings.
Audit Metadata