ClawHub
Back to skill

Security audit

Travel Agent Skill

Security checks across malware telemetry and agentic risk

Overview

This travel-booking skill is transparent about using email and BonBook’s website to book, change, or cancel flights, with repeated human-approval requirements.

Install only if you trust BonBook and are comfortable letting your agent send and read BonBook-related email. Review each itinerary, price, refund rule, change, cancellation, calendar sync, PII entry, and payment step yourself, and do not put passport numbers, card numbers, credentials, or unnecessary personal data into email.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The README promotes booking, changing, and cancelling flights through a single email workflow without warning that sensitive personal/travel data will be shared and that the skill can trigger real account-impacting actions. In the context of a travel-booking skill, this omission increases the risk of unintended purchases, itinerary changes, cancellations, or disclosure of passenger information by users or downstream agents who may treat the action as low-risk.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.