Is ITA Matrix Powertools safe?

Medium risk

ITA Matrix Powertools sends clicked booking links and the current Matrix page URL to Skimresources by default.

On ITA Matrix result pages, it builds airline booking links from parsed itinerary details such as routes, dates, flight numbers, fare basis, passenger counts, cabin, and price. When affiliate support is enabled by default, clicking a generated booking link opens go.skimresources.com with the booking URL and current Matrix page URL encoded as parameters.

Rangecrestv0.56.1Chrome Web Store
45Risk
Who publishes it

Rangecrest - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Rangecrest
Website
www.flyertalk.com/forum/travel-tools/1623427-ita-purchase-fares-orbitz-delta-userscript.html

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Booking-link clicks send Matrix URLs to Skimresources

When you click a generated booking link in ITA Matrix Powertools, the extension routes it through Skimresources by default.

The request carries the booking URL and the current ITA Matrix page URL, exposing trip search and itinerary context.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

Clicks a generated booking link from an ITA Matrix result.

The extension did this

Routes the click through Skimresources with the generated booking URL and current Matrix URL as parameters.

Captured request
GEThttps://go.skimresources.com/
Fields in the request
  • Generated booking URL
    https://airline.example/book?origin=SFO&destination=IST (illustrative)

    This can include itinerary details such as route, dates, flight numbers, fare basis, cabin, passenger count, and price.

  • Current Matrix page URL
    https://matrix.itasoftware.com/search (illustrative)

    This identifies the ITA Matrix page you were viewing when the booking link was clicked.

Where it sends data

Destinations our analysis observed ITA Matrix Powertools contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • go.skimresources.com

    ITA Matrix Powertools sends data to go.skimresources.com. 2 other extensions we have analysed send data here.

Updated 30 September 2026menecfddnlmanmpadcalononkolnplpp