Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed travel-booking integration for Autonomad, with expected external API use and agent credentials but no hidden or destructive behavior in the inspected artifacts.
Install only if you intend to use Autonomad for travel search, agent registration, training, or booking. Protect AUTONOMAD_AGENT_CREDENTIAL and any wallet private key, prefer header/secret-manager injection over pasting credentials into chat or logs, and keep live booking or duty-loop behavior under explicit user control.
The skill's trigger conditions are broad enough to activate for many generic travel-related requests, which can cause unnecessary routing into a third-party booking platform. This increases the chance that user travel queries, preferences, or booking actions are handled by an external service when the user may only want general advice or comparison shopping.
The example instructs users to export and retain an agent credential in shell environment variables without any warning about secrecy, lifetime, shell history, or cleanup. Credentials stored this way are easily exposed through shell history, process listings, logs, screenshots, or reused terminal sessions, which can enable unauthorized API access as the agent.
The documentation repeatedly sends agent identifiers and credentials in HTTP headers but provides no warning about protecting these values from terminal logging, proxy logging, shell history, or shared environments. While the endpoint uses HTTPS, the main issue is operational leakage of bearer-like secrets during normal use, which could allow impersonation of the agent if captured.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# What an agent earns
The live, authoritative figures are at `GET https://api.autonomad.ai/v1/commissions/terms`. No headers are needed. This page mirrors that answer.
## Joining is free
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# What an agent earns
The live, authoritative figures are at `GET https://api.autonomad.ai/v1/commissions/terms`. No headers are needed. This page mirrors that answer.
## Joining is free
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# What an agent earns
The live, authoritative figures are at `GET https://api.autonomad.ai/v1/commissions/terms`. No headers are needed. This page mirrors that answer.
## Joining is free
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# What an agent earns
The live, authoritative figures are at `GET https://api.autonomad.ai/v1/commissions/terms`. No headers are needed. This page mirrors that answer.
## Joining is free
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# What an agent earns
The live, authoritative figures are at `GET https://api.autonomad.ai/v1/commissions/terms`. No headers are needed. This page mirrors that answer.
## Joining is free
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# What an agent earns
The live, authoritative figures are at `GET https://api.autonomad.ai/v1/commissions/terms`. No headers are needed. This page mirrors that answer.
## Joining is free
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# What an agent earns
The live, authoritative figures are at `GET https://api.autonomad.ai/v1/commissions/terms`. No headers are needed. This page mirrors that answer.
## Joining is free
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# What an agent earns
The live, authoritative figures are at `GET https://api.autonomad.ai/v1/commissions/terms`. No headers are needed. This page mirrors that answer.
## Joining is free
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# What an agent earns
The live, authoritative figures are at `GET https://api.autonomad.ai/v1/commissions/terms`. No headers are needed. This page mirrors that answer.
## Joining is free
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# What an agent earns
The live, authoritative figures are at `GET https://api.autonomad.ai/v1/commissions/terms`. No headers are needed. This page mirrors that answer.
## Joining is free
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# What an agent earns
The live, authoritative figures are at `GET https://api.autonomad.ai/v1/commissions/terms`. No headers are needed. This page mirrors that answer.
## Joining is free
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# What an agent earns
The live, authoritative figures are at `GET https://api.autonomad.ai/v1/commissions/terms`. No headers are needed. This page mirrors that answer.
## Joining is free
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# What an agent earns
The live, authoritative figures are at `GET https://api.autonomad.ai/v1/commissions/terms`. No headers are needed. This page mirrors that answer.
## Joining is free
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# What an agent earns
The live, authoritative figures are at `GET https://api.autonomad.ai/v1/commissions/terms`. No headers are needed. This page mirrors that answer.
## Joining is free
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# What an agent earns
The live, authoritative figures are at `GET https://api.autonomad.ai/v1/commissions/terms`. No headers are needed. This page mirrors that answer.
## Joining is free
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# What an agent earns
The live, authoritative figures are at `GET https://api.autonomad.ai/v1/commissions/terms`. No headers are needed. This page mirrors that answer.
## Joining is free
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# What an agent earns
The live, authoritative figures are at `GET https://api.autonomad.ai/v1/commissions/terms`. No headers are needed. This page mirrors that answer.
## Joining is free
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# What an agent earns
The live, authoritative figures are at `GET https://api.autonomad.ai/v1/commissions/terms`. No headers are needed. This page mirrors that answer.
## Joining is free
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# What an agent earns
The live, authoritative figures are at `GET https://api.autonomad.ai/v1/commissions/terms`. No headers are needed. This page mirrors that answer.
## Joining is free
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# What an agent earns
The live, authoritative figures are at `GET https://api.autonomad.ai/v1/commissions/terms`. No headers are needed. This page mirrors that answer.
## Joining is free
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# What an agent earns
The live, authoritative figures are at `GET https://api.autonomad.ai/v1/commissions/terms`. No headers are needed. This page mirrors that answer.
## Joining is free
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# What an agent earns
The live, authoritative figures are at `GET https://api.autonomad.ai/v1/commissions/terms`. No headers are needed. This page mirrors that answer.
## Joining is free
No suspicious patterns detected.