Trust Assessment
flight-tracker received a trust score of 77/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 3 findings: 0 critical, 1 high, 1 medium, and 1 low severity. Key findings include Suspicious import: requests, API key and flight data transmitted over unencrypted HTTP, Unpinned 'requests' dependency.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | API key and flight data transmitted over unencrypted HTTP The skill's `scripts/track_flight.py` uses `http://api.aviationstack.com` for its API calls. This means the `AVIATIONSTACK_API_KEY` and user-provided `flight_number` are sent over an unencrypted connection. This makes them vulnerable to interception by attackers on the network (e.g., Man-in-the-Middle attacks), potentially leading to API key compromise and exposure of flight tracking data. If possible, use HTTPS for all API communications. If the free tier does not support HTTPS, this limitation should be clearly communicated to the user, and the skill should advise against using it for sensitive flight information or in untrusted network environments. Consider upgrading to a paid plan or using an alternative API that supports HTTPS. | LLM | scripts/track_flight.py:30 | |
| MEDIUM | Suspicious import: requests Import of 'requests' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration. | Static | skills/copey02/aviationstack-flight-tracker/scripts/track_flight.py:15 | |
| LOW | Unpinned 'requests' dependency The `SKILL.md` instructs `pip3 install requests` without specifying a version. This can lead to non-deterministic builds and potential compatibility issues or security vulnerabilities if a future version of `requests` introduces breaking changes or new vulnerabilities. While `requests` is a widely used library, best practice dictates pinning dependencies to a specific version. Pin the `requests` dependency to a specific version (e.g., `pip3 install requests==2.28.1`) or use a `requirements.txt` file with pinned versions to ensure consistent and secure deployments. | LLM | SKILL.md:20 |
Scan History
Embed Code
[](https://skillshield.io/report/f27fbc2741dabd14)
Powered by SkillShield