ClawHub

Booking

Security checks across malware telemetry and agentic risk

Overview

This is a coherent accommodation-booking helper, with expected but important privacy and transaction risks to review before use.

Install only if you are comfortable with the skill checking live travel sites and keeping local booking memory. Before any actual reservation, review the exact property, dates, guests, total price, payment terms, and cancellation deadline.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The skill description is broad enough to capture many generic travel or lodging-related requests, which can cause unintended activation for tasks the user did not explicitly delegate to this skill. In this skill's context, that is more dangerous because the skill is designed for end-to-end execution, including booking actions, so ambiguous activation could lead to privacy exposure or unintended transactions.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs storage of traveler preferences, booking history, and alerts in local files under the user's home directory without any user-facing notice, consent flow, retention policy, or sensitivity guidance. This creates privacy and data-handling risk because personal travel patterns, budgets, and past bookings can reveal sensitive behavioral information and may persist longer than the user expects.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal