Travel Concierge CLI

PassAudited by VirusTotal on May 12, 2026.

Overview

Type: OpenClaw Skill Name: travel-concierge Version: 1.0.1 The skill bundle defines a 'travel-concierge' agent skill. The `SKILL.md` instructs the agent to execute a local CLI tool `travel-concierge` to find contact details for accommodation listings and to configure an optional Google Places API key. All instructions are directly aligned with the stated purpose, and there is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts against the agent. The `vitest.config.ts` file is a standard test configuration and poses no security risk.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Concern

ASI04: Agentic Supply Chain Vulnerabilities

What this means

The agent may try to execute a local `travel-concierge` command whose behavior was not reviewed as part of this skill.

Why it was flagged

This is the primary workflow, but the provided metadata/install data declare no required binary or installer and the package does not include the CLI implementation.

Skill content

Run the CLI to extract contact information: `travel-concierge find-contact "<url>"`

Recommendation

Install only if you can verify exactly which `travel-concierge` executable will run and trust its source.

Note

ASI03: Identity and Privilege Abuse

What this means

A Google API key could be used for Places API requests and may incur quota usage or costs.

Why it was flagged

The skill can store and use a Google Places API key. This is purpose-aligned, but credential handling is not described in the reviewed artifacts.

Skill content

travel-concierge config set googlePlacesApiKey "your-key"

Recommendation

Use a restricted, quota-limited API key and confirm how the CLI stores and uses it before configuring it.

Note

ASI02: Tool Misuse and Exploitation

What this means

The agent may access booking-platform pages and automate a browser to gather contact details.

Why it was flagged

The skill discloses scraping and browser automation, which fit the contact-finding purpose but can interact with third-party sites in ways users should approve.

Skill content

The tool works without any API keys using web scraping. Browser automation (via `agent-browser`) may be needed for JavaScript-rendered listing pages

Recommendation

Use it only for listings you choose, avoid logged-in/private pages unless necessary, and consider site terms and privacy expectations.