@tank/flight-search
Pass
Audited by Gen Agent Trust Hub on May 31, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes the 'fast-flights' open-source package and 'playwright' for high-performance flight data retrieval. These are legitimate dependencies required for the skill's primary functionality of interfacing with Google Flights via reverse-engineered protobufs.
- [COMMAND_EXECUTION]: The included BDD test suite ('.bdd/interactions/cli_runner.py') contains a 'FlightCliRunner' class that uses 'subprocess.run' to execute the skill's own scripts during local testing. This implementation is safe as it targets only internal scripts and uses the current system's Python interpreter.
- [SAFE]: The skill implements secure credential management by requiring API keys (SerpAPI, Amadeus, Travelpayouts, RapidAPI) to be provided as environment variables rather than being hardcoded in scripts or configuration files.
- [SAFE]: Network activity is restricted to necessary travel-related domains as specified in the 'tank.json' permissions, and no evidence of data exfiltration or access to sensitive local files was found.
- [SAFE]: The skill logic is transparent, well-documented, and free of obfuscation or prompt injection attempts.
Audit Metadata