Aerobase Travel Activities

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

The agent may use your Aerobase API quota or paid plan when making travel activity searches.

Why it was flagged

The skill requires a provider API key and uses it for authenticated Aerobase calls; this is disclosed and aligned with the travel API purpose.

Skill content

Required env var: `AEROBASE_API_KEY`; Auth header (preferred): `Authorization: Bearer ${AEROBASE_API_KEY}`; Never print raw API keys in output

Recommendation

Use a dedicated Aerobase API key, monitor usage or billing limits, and do not provide unrelated credentials.

Note

ASI02: Tool Misuse and Exploitation

What this means

Destination, airport, and activity-search details may be sent to Aerobase to generate recommendations.

Why it was flagged

The skill directs the agent to call an external API, but the documented operations are read-only travel search endpoints and are purpose-aligned.

Skill content

Base URL: `https://aerobase.app`; Endpoints: GET /api/attractions, GET /api/attractions/{slug}/tours, GET /api/tours

Recommendation

Use the skill for intended travel-planning queries and avoid including unnecessary sensitive personal details in search requests.