ClawHub
Back to skill

Security audit

Tripadvisor

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly purpose-aligned, but needs review because its API examples place the Tripadvisor API key in URL command arguments while the privacy text understates credential transmission.

Install only if you are comfortable sending travel searches and your Tripadvisor API key to Tripadvisor. Prefer limiting or rotating the API key, avoid shell tracing or verbose command logging, and do not enable broad activation on generic terms like hotels or attractions unless you want this skill to persist those preferences locally.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
api-workflows.md:7
Finding

Tripadvisor API Key Exposed in Command-Line URL Query Parameters

Content
View full analysis

Vulnerability Details

File Location: api-workflows.md:7, api-workflows.md:15-16, api-workflows.md:35-36, and api-workflows.md:42-43
Vulnerability Type: API credential exposure through URL query parameters and process arguments
Risk Level: Medium

Complete Vulnerable Code

bash
curl -sS -i "https://api.tripadvisor.com/api/partner/2.0/location/search?query=Madrid&key=${TRIPADVISOR_API_KEY}" | sed -n '1,20p'
bash
curl -sS "https://api.tripadvisor.com/api/partner/2.0/location/search?query=Madrid&key=${TRIPADVISOR_API_KEY}" \
  | jq '.data[] | {location_id, name, result_type, address_obj}'
bash
curl -sS "https://api.tripadvisor.com/api/partner/2.0/location/${LOCATION_ID}?key=${TRIPADVISOR_API_KEY}" \
  | jq '{location_id, name, rating, num_reviews, ranking_data, price_level, web_url}'
bash
curl -sS "https://api.tripadvisor.com/api/partner/2.0/location/${LOCATION_ID}/nearby_search?key=${TRIPADVISOR_API_KEY}" \
  | jq '.data[] | {location_id, name, rating, num_reviews}'

Technical Analysis

The documented commands expand TRIPADVISOR_API_KEY directly into curl's command-line URL. HTTPS protects the request while it is in transit, but it does not prevent local or endpoint-side disclosure of the complete URL.

The expanded credential may be exposed through:

  • Process-argument inspection or process telemetry.
  • Shell tracing and diagnostic output.
  • Command auditing and execution records.
  • Proxy, gateway, monitoring, or server access logs that record URLs.
  • Error reports containing the request URL.

The logging rule in api-workflows.md:21-29 instructs the Agent to redact keys from its own request log. This is a useful safeguard, but it does not prevent the other disclosure channels because the secret is already present in the invoked command's URL.

Network access to Tripadvisor is necessary for the Skill's declared search and comparison functionality. The primary issue is therefore not unauthori ...[truncated 1131 chars]

Remediation
View remediation

Remediation Suggestions

  1. Use Tripadvisor's supported authentication header rather than a URL query parameter, if the API supports one. For example, use an authorization or API-key header according to the current official API documentation.
  2. If query-parameter authentication is mandatory, use an HTTP client or protected configuration mechanism that does not expose the expanded secret in process arguments.
  3. Disable shell tracing and verbose request diagnostics around credential-bearing requests.
  4. Ensure application, proxy, gateway, monitoring, and server logs redact the key parameter.
  5. Avoid printing complete request URLs in error messages or audit records.
  6. Restrict the API key to the minimum available endpoints, quota, origin, and client permissions.
  7. Rotate any key that may already have appeared in process telemetry, shell traces, diagnostic records, or URL logs.
  8. Retain the existing local redaction rule, but clarify that it supplements rather than replaces secure credential transport and handling.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

1) Connectivity check

bash
curl -sS -i "https://api.tripadvisor.com/api/partner/2.0/location/search?query=Madrid&key=${TRIPADVISOR_API_KEY}" | sed -n '1,20p'

Expected failure without valid key:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

1) Connectivity check

bash
curl -sS -i "https://api.tripadvisor.com/api/partner/2.0/location/search?query=Madrid&key=${TRIPADVISOR_API_KEY}" | sed -n '1,20p'

Expected failure without valid key:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · api-workflows.md (reported line 8)May include surrounding context.

1) Connectivity check

bash
curl -sS -i "https://api.tripadvisor.com/api/partner/2.0/location/search?query=Madrid&key=${TRIPADVISOR_API_KEY}" | sed -n '1,20p'

Expected failure without valid key:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · api-workflows.md (reported line 18)May include surrounding context.

1) Connectivity check

bash
curl -sS -i "https://api.tripadvisor.com/api/partner/2.0/location/search?query=Madrid&key=${TRIPADVISOR_API_KEY}" | sed -n '1,20p'

Expected failure without valid key:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · api-workflows.md (reported line 37)May include surrounding context.

1) Connectivity check

bash
curl -sS -i "https://api.tripadvisor.com/api/partner/2.0/location/search?query=Madrid&key=${TRIPADVISOR_API_KEY}" | sed -n '1,20p'

Expected failure without valid key:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · api-workflows.md (reported line 44)May include surrounding context.

1) Connectivity check

bash
curl -sS -i "https://api.tripadvisor.com/api/partner/2.0/location/search?query=Madrid&key=${TRIPADVISOR_API_KEY}" | sed -n '1,20p'

Expected failure without valid key:

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The setup instructs the skill to activate whenever the user mentions broad terms like 'Tripadvisor,' 'hotels,' 'attractions,' or 'restaurant comparisons,' which can easily appear in ordinary travel discussions that do not imply consent to use this skill. This can cause unintended persistence of preferences to local storage and unexpected tool or browser use, increasing privacy and autonomy risks even if the underlying workflows are legitimate.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.