Security audit
Security checks for vulnerabilities and agentic risk
The skill is openly designed for Airbnb operations, but its calendar-mutation procedure uses broad authenticated browser control with unsafe token and temporary-file handling for a live business account.
Review this carefully before installing in a production Airbnb environment. Only use it with a trusted local bridge, a logged-in account you own, short-lived or scoped tokens if possible, a private unique temp-file path, and a human approval process for every guest send or calendar/price change.
references/calendar-mutation-procedure.md:20Privileged ClawBridge bearer token transmitted over plaintext HTTP and exposed through command arguments
references/calendar-mutation-procedure.md:52Predictable shared temporary file permits browser-evaluation payload collision or substitution
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
and a **Completion rule** (a MUTATE-CAL turn must end with a report or an
explicit unconfirmed/failure statement; NO_REPLY forbidden).
- v0.2.1: `references/calendar-mutation-procedure.md` — added a
**Transport rule**: ClawBridge calls go through exec + curl ONLY; the built-in
`fetch`/`web_fetch` tool can't send the Authorization header and internal
hosts are blocked for it — it killed two live runs on 2026-07-04 at the
verification step (agents drift to it under pressure; now explicitly
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
`send_reply` is the only guest-messaging write, and it internally enforces
read → draft → approve → send-once → verify → report. Agents must not decompose
it into lower-level steps to skip verification. Calendar mutation (MUTATE-CAL) is
not a command verb here — it is the separate, approval-gated procedure in
`references/calendar-mutation-procedure.md` (see "Approved calendar mutations
(v0.2)"), which follows the same read → approve → do-once → verify → report shape.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
# Example — `check_inbox`
A READ operation. No approval, no write. Goal: surface threads needing attention,
prioritized, without changing anything.
> Tool names below are from the reference deployment. Map them via
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
# Example — `check_inbox`
A READ operation. No approval, no write. Goal: surface threads needing attention,
prioritized, without changing anything.
> Tool names below are from the reference deployment. Map them via
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
# Example — `check_inbox`
A READ operation. No approval, no write. Goal: surface threads needing attention,
prioritized, without changing anything.
> Tool names below are from the reference deployment. Map them via
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Payload rule — NEVER inline JS into a quoted `-d` argument
The eval scripts below are full of single quotes. Wrapping them in `curl -d '...'`
breaks shell quoting (curl exits 3 "URL malformed" — observed live 2026-07-04, seven
consecutive failures). Instead, for EVERY `/tools/browser/eval` call:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- A ✓ Done response does NOT mean the UI registered the interaction — only the
side panel opening / radio flipping / fresh-load label proves anything.
- Success claims without the Step-5 fresh-load check are the #1 failure mode.
- Inlining eval JS into `curl -d '...'` mangles shell quoting — always use the
write-file + `-d @file` pattern (see Payload rule above).
- Using the built-in `fetch`/`web_fetch` tool for ClawBridge endpoints always
fails (no auth header, internal host blocked) — exec + curl only (see
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
> ⚠️ **THIS CHANGES LIVE PRODUCTION INVENTORY.** Every step below alters the real
> Airbnb listing: blocking a date removes a night from sale; opening one exposes
> it; a price change is live to every guest immediately. There is no "preview"
> and no reliable undo beyond the stated inverse operation. **Do NOT run any step
> of this procedure exploratorily, to "see what happens", or on your own
> initiative.** It executes ONLY under the MUTATE-CAL gate in `SKILL.md` →
> "Approved calendar mutations (v0.2)": the operator named the exact date(s)/field
No suspicious patterns detected.