ClawHub
Back to skill

Security audit

Aerobase Travel Concierge

Security checks for vulnerabilities and agentic risk

Overview

The skill is not deceptive, but it can use an Aerobase API key to book or cancel travel and change wallet or payment-related data without clearly requiring user confirmation.

Review this skill carefully before installing. Only use it if you trust Aerobase with travel, booking, wallet, payment, and boarding-pass data, and require your agent to get explicit approval before any booking, cancellation, deletion, alert creation, or wallet/card/loyalty change.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)

Tool Parameter Abuse

High
Category
Tool Misuse
Content
- `GET /api/v1/hotels/bookings?guestId=...` - List bookings by guest
- `GET /api/v1/hotels/bookings/all` - All bookings with date filters
- `GET /api/v1/hotels/bookings/{id}` - Booking detail
- `DELETE /api/v1/hotels/bookings/{id}` - Cancel booking
- `POST /api/v1/hotels/bookings/{id}/amend` - Get alternative rates for amendments
- `GET /api/v1/hotels/chains` - Hotel chain reference data
- `GET /api/v1/hotels/currencies` - Supported currencies
Confidence
80% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
- `GET /api/v1/wallet` - Full wallet summary
- `GET /api/v1/wallet/cards` - List credit cards
- `POST /api/v1/wallet/cards` - Add credit card
- `DELETE /api/v1/wallet/cards` - Remove credit card
- `GET /api/v1/wallet/points` - List point balances
- `PUT /api/v1/wallet/points` - Update point balance
- `DELETE /api/v1/wallet/points` - Remove point balance
Confidence
80% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
- `DELETE /api/v1/wallet/cards` - Remove credit card
- `GET /api/v1/wallet/points` - List point balances
- `PUT /api/v1/wallet/points` - Update point balance
- `DELETE /api/v1/wallet/points` - Remove point balance
- `GET /api/v1/wallet/programs` - List loyalty programs
- `POST /api/v1/wallet/programs` - Add loyalty program
- `DELETE /api/v1/wallet/programs` - Remove loyalty program
Confidence
80% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
- `DELETE /api/v1/wallet/points` - Remove point balance
- `GET /api/v1/wallet/programs` - List loyalty programs
- `POST /api/v1/wallet/programs` - Add loyalty program
- `DELETE /api/v1/wallet/programs` - Remove loyalty program
- `GET /api/v1/credit-cards` - Credit card transfer partners

### Recovery
Confidence
80% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
### Saved Items
- `GET /api/v1/saved-items` - List saved items
- `POST /api/v1/saved-items` - Save an item
- `DELETE /api/v1/saved-items/{id}` - Remove saved item

### Itinerary
- `POST /api/v1/itinerary/plan` - Generate itinerary plan
Confidence
80% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Vague Triggers

Medium
Confidence
89% confidence
Finding
The skill is positioned as an all-in-one travel concierge with very broad capabilities, but it does not define clear invocation boundaries or explicit gating for high-risk actions. In an agentic environment, this can cause unintended activation for loosely related travel queries and may escalate into transactional actions like booking or cancellation without sufficiently narrow user intent.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
- Base URL: `https://aerobase.app`
- Required env var: `AEROBASE_API_KEY`
- Auth header (preferred): `Authorization: Bearer ${AEROBASE_API_KEY}`
- Never ask users for passwords, OTPs, cookies, or third-party logins.
- Never print raw API keys in output; redact as `sk_live_***`.

### Request rules
Confidence
80% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The documentation advertises hotel prebooking, booking, and cancellation capabilities, but it does not clearly require confirmation before actions that can create, change, or cancel reservations or incur charges. In a travel concierge context, this is dangerous because an agent may execute irreversible or billable actions based on incomplete, inferred, or ambiguous user intent.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The reference exposes numerous booking, payment, wallet, loyalty, and deletion endpoints without any accompanying guidance on confirmation requirements, sensitive-data handling, or least-privilege usage. In an agent skill context, this increases the chance that downstream tool implementations or prompts will invoke high-risk operations on behalf of a user without adequate consent or privacy safeguards.

Static analysis

No suspicious patterns detected.