travel-accommodation-research

• Outcome: Pass
• Latest audit: Sep 17, 2026 · 11:33 AM UTC
• Version: 1.0.1

Overview

This skill is a disclosed travel research helper that sends travel search parameters to Crawlora, with no booking, payment, persistence, or hidden local control behavior found.

Install only if you are comfortable sending destination searches, dates, occupancy details, property IDs, and similar travel research data to Crawlora using your Crawlora API key. Do not include sensitive personal details beyond what is needed for the search, and verify prices or availability on the original booking platform before acting.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill instructs users to run a shell script and supply an API key, but it does not declare any explicit tool scope such as allowed shell usage or constrained permissions. That mismatch weakens policy enforcement and increases the risk that a consuming agent may execute shell commands with broader capabilities than intended, especially if later edits add unsafe command construction or external inputs.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation states that user-supplied travel queries, IDs, dates, and other parameters are sent to an external API, but it provides no user-facing disclosure or consent guidance. This creates a privacy and data-handling risk because users may provide itinerary details, location data, and identifiers without understanding they are being transmitted to a third-party service.

External Transmission

Medium

• Category: Data Exfiltration

Content

Endpoints this skill uses, grouped by platform. Call them via `scripts/crawlora.sh` (see SKILL.md).

All paths are relative to the API base `https://api.crawlora.net/api/v1` and require the header `x-api-key: $CRAWLORA_API_KEY`. Path params like `{id}` are substituted into the URL; `GET` params go in the query string; `POST` params go in a JSON body.

**24 endpoints across 4 platform group(s).**

• Confidence: 92% confidence
• Finding: The file explicitly directs the skill to transmit request data to an external domain, and many endpoints accept user-provided travel searches, dates, location terms, and identifiers. In this travel-research context, external transmission is expected, but it is still security-relevant because it expands the trust boundary and can expose personal travel patterns or other sensitive query data to a third-party API.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# config supplies the header and is removed automatically on exit.
umask 077
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

External Transmission

Medium

• Category: Data Exfiltration

Content

[ -n "$body" ] || body='{}'
  # Stream the body on stdin so curl never interprets a user value as its
  # @file shorthand (and cannot read local files supplied in a request body).
  printf '%s' "$body" | curl -q -fsS -X "$method" "${auth[@]}" \
    -H "Content-Type: application/json" --data-binary @- "${base}${path}"
fi

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Vague Triggers

Low

• Confidence: 84% confidence
• Finding: This markdown file describes what the skill uses and how to call endpoints, but it does not define when the skill should or should not activate. For markdown files, missing specificity on trigger scope can create ambiguity about invocation boundaries, especially when paired with a general-purpose skill reference.

Missing User Warnings

Low

• Confidence: 81% confidence
• Finding: The file states that requests require the header x-api-key: $CRAWLORA_API_KEY, indicating use of a sensitive credential. There is no accompanying warning or guidance about protecting the key or ensuring users understand that authenticated third-party access is involved.

Static analysis

No suspicious patterns detected.