flights
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill documentation recommends installing the
uvtool using a standard installation script from Astral (https://astral.sh/uv/install.sh). Astral is a well-known organization in the Python developer ecosystem, and this is their official installation method. - [EXTERNAL_DOWNLOADS]: The skill depends on the
fast-flightsPython library, a public package used to interface with flight data. It also references and generates links to official airline booking portals, such as those for United Airlines, Delta, and American Airlines, which are well-known services. - [INDIRECT_PROMPT_INJECTION]: The skill fetches flight information from external sources (Google Flights). This represents an attack surface where malicious data could potentially be embedded in flight results. However, the skill only parses and displays this data as text output (airline names, prices, times) and does not use the retrieved information to trigger sensitive commands, file system operations, or further network requests.
- Ingestion points: Data is retrieved from the Google Flights API via the
fast_flightslibrary inscripts/flights-search. - Boundary markers: None explicitly present in the script output.
- Capability inventory: The skill performs terminal output and generates URL links; it does not perform file writes or execute arbitrary code.
- Sanitization: The script performs basic parsing and formatting of flight attributes before display.
Audit Metadata