Google SERP Hotels Search API

• Outcome: Pass
• Latest audit: Jun 9, 2026 at 1:50 PM UTC
• Version:
  1.0.1

Overview

This skill is a narrowly scoped hotel-search API helper that sends declared search parameters to Just Serp API using the user's API key.

Install only if you are comfortable sharing hotel search terms, dates, and filters with Just Serp API and using a JUST_SERP_API_KEY for that service. Avoid using it for sensitive travel plans unless that sharing is acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly directs sending user-provided travel search data, including destination queries and stay dates, to an external third-party API, but it does not instruct the agent to clearly warn the user or obtain consent before transmitting that data. While the data is not highly sensitive by default, travel plans can reveal personal or business intent, making silent exfiltration to an external service a meaningful privacy risk.

VirusTotal

60/60 vendors flagged this skill as clean.