Security audit
Autonomad Travel
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a straightforward Autonomad travel connector that discloses its external service use, optional sign-in, and booking flow.
Before installing, understand that searches and booking-link creation go through Autonomad's hosted MCP service. Searching does not require sign-in, but signing in with OAuth may allow the agent to view trip updates and request booking changes or cancellations, so keep normal OpenClaw tool approval controls in place for those actions.
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Static analysis
No suspicious patterns detected.