Security audit

Hostex

Security checks across malware telemetry and agentic risk

Overview

This is a coherent Hostex API helper, but it can expose guest data and perform account changes if the user enables writes.

Install only if you intend to let an agent access Hostex account data. Use a read-only or least-privilege Hostex token where possible, keep HOSTEX_ALLOW_WRITES unset except for a specific approved change, review dry-run/planned write output before confirming, avoid broad reservation or conversation retrieval unless needed, and do not set HOSTEX_BASE_URL unless it points to a trusted Hostex endpoint.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The skill metadata says PAT-based access with optional writes, but the OpenAPI spec also exposes OAuth token issuance and revocation endpoints that accept client_id and client_secret and return access/refresh tokens. In an agent setting, this broadens the capability surface from ordinary API use to credential-handling and token lifecycle management, increasing the chance of secret collection, misuse, or accidental exfiltration.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The reservations endpoints expose substantial guest PII, including names, phone numbers, email addresses, ID document data, gender, country, lock codes, and check-in details, without any privacy-handling warning or minimization guidance. In an agent workflow, this can lead to over-collection, unnecessary display, or downstream disclosure of regulated personal and access-related information.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: Conversation and message retrieval includes guest contact details and full message content without warning that these fields may contain sensitive personal or confidential information. In a conversational agent, such content can be surfaced, summarized, or transmitted onward in ways the user may not expect.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The OAuth endpoints require client_secret and token values but do not warn that these are sensitive credentials that must be protected from logging, reuse, or disclosure. In an agent context, omission of such guidance materially raises the risk that secrets are pasted into prompts, stored in transcripts, or exposed in tool outputs.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/hostex-client.mjs:6