Track Flight

Track flights in real-time with detailed status, gate info, delays, and live position. Use when user asks to track a flight, check flight status, look up fli...

What to consider before installing: - The script and docs require an AVIATIONSTACK_API_KEY but the registry metadata does not declare this — the skill will fail unless you set that env var. Treat that as a metadata omission and verify you are comfortable providing the key. - The SKILL.md warns the free AviationStack tier is HTTP-only: the script sends your API key as a query parameter over plain HTTP, which can expose it on networks or to intermediaries. Prefer not to use this skill with your primary/long-lived API key on untrusted networks. If possible, use a paid AviationStack plan (HTTPS) or a proxy that upgrades to HTTPS. - Verify the skill provenance: the _meta.json owner differs from the registry owner ID; confirm you trust the source or run the script in an isolated environment first. - Before running, inspect the included scripts (you can run them in a sandbox) and avoid pasting your API key into shared shells or logs. Consider creating a limited/throwaway API key if the provider supports it. Given the metadata omissions and the insecure transport of the API key, proceed only after you accept these risks or after the author fixes the metadata and the script is configured to use HTTPS endpoints.

Type: OpenClaw Skill Name: track-flight Version: 1.0.0 The skill's primary function is benign, but it uses HTTP for API communication with `http://api.aviationstack.com` as explicitly noted in `SKILL.md` and `references/api-setup.md`. The `scripts/track_flight.py` script transmits the `AVIATIONSTACK_API_KEY` in plaintext over HTTP, which is a significant vulnerability (Man-in-the-Middle risk) that could lead to API key compromise. While this is a limitation of the external API's free tier and is openly declared, it constitutes insecure data transmission, classifying the skill as suspicious.