ClawHub
Back to skill

Security audit

TripGo API

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent TripGo API wrapper; it sends travel and location data to TripGo as expected, with privacy-sensitive use that users should understand.

Install only if you are comfortable sending route searches, coordinates, schedules, trip identifiers, and related travel metadata to TripGo. Keep webhook allowlisting enabled, use only trusted HTTPS callback domains, avoid unnecessary home/work labels in requests, and double-check IDs before running scripts that save, mark, delete, or otherwise change remote trip state.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The documentation explicitly supports sending highly sensitive location and itinerary data, including habitual events such as home and work, to a third-party API without any privacy notice, consent guidance, retention caveats, or data-minimization advice. In a skill context, this can normalize collection and external transmission of precise movement patterns that may expose home/work locations, routines, and presence information.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The webhook registration docs explicitly describe sending tripID and tripURL to an arbitrary callback URL but do not warn that this transmits trip-related data to a third party and may expose sensitive travel information if misconfigured. In a skill context, this omission can lead downstream agents or developers to register external endpoints without considering privacy, trust boundaries, authentication, or callback URL validation.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The planned-trip analytics endpoint is documented as tracking which returned trips the user actually took, but the docs do not provide a user-facing warning about collection of trip-usage data or privacy implications. In this travel-planning context, trip history can reveal sensitive movement patterns, so omission of disclosure and consent guidance increases privacy risk.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.