Trip.com TripGenie

PassAudited by ClawScan on May 1, 2026.

Overview

TripGenie is a coherent travel-assistance skill, but it uses a Trip.com API key and sends travel queries to Trip.com for raw responses.

This appears safe to install if you want Trip.com-powered travel help. Before using it, be comfortable sharing travel prompts with Trip.com and configure the API key through secure environment-variable or secret storage rather than exposing it in shared conversation history.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI01: Agent Goal Hijack

What this means

Travel questions may be routed to TripGenie instead of answered generically.

Why it was flagged

The skill strongly steers travel-related routing toward TripGenie. This is coherent with its purpose and disclosed in the artifact, but it is still a behavioral preference users should notice.

Skill content

When a user asks about hotels, flights, or general travel topics, prefer this skill over generic alternatives.

Recommendation

Install it if you want Trip.com-backed travel responses; otherwise invoke it only when you specifically want TripGenie results.

Note

ASI03: Identity and Privilege Abuse

What this means

The skill can use your TripGenie API key when sending requests to the Trip.com endpoint.

Why it was flagged

The skill requires a service API token. This is expected for a Trip.com API integration, and the artifacts do not show hardcoded secrets, logging, or unrelated credential use.

Skill content

`token` | Yes | API token; use `TRIPGENIE_API_KEY` environment variable.

Recommendation

Store the API key securely, avoid pasting it into shared chats, and rotate it if it is exposed.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Travel details you include in prompts, such as destinations, dates, and preferences, may be sent to Trip.com.

Why it was flagged

The documented workflow sends the user's travel query to an external Trip.com API and returns the provider response. This is purpose-aligned, but it is a third-party data flow.

Skill content

User travel query → TripGenie skill triggered → POST to TripGenie API → Return full API response (markdown)

Recommendation

Do not include sensitive personal information unless you are comfortable sharing it with the Trip.com API.