ClawHub
Back to skill

Security audit

Aerobase Travel Concierge

Security checks for vulnerabilities and agentic risk

Overview

The skill is not deceptive, but it can use an Aerobase API key to book or cancel travel and change wallet or payment-related data without clearly requiring user confirmation.

Review this skill carefully before installing. Only use it if you trust Aerobase with travel, booking, wallet, payment, and boarding-pass data, and require your agent to get explicit approval before any booking, cancellation, deletion, alert creation, or wallet/card/loyalty change.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/aerobase-api.md (reported line 39)May include surrounding context.

md
- `GET /api/v1/hotels/bookings?guestId=...` - List bookings by guest
- `GET /api/v1/hotels/bookings/all` - All bookings with date filters
- `GET /api/v1/hotels/bookings/{id}` - Booking detail
- `DELETE /api/v1/hotels/bookings/{id}` - Cancel booking
- `POST /api/v1/hotels/bookings/{id}/amend` - Get alternative rates for amendments
- `GET /api/v1/hotels/chains` - Hotel chain reference data
- `GET /api/v1/hotels/currencies` - Supported currencies

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/aerobase-api.md (reported line 69)May include surrounding context.

md
- `GET /api/v1/wallet` - Full wallet summary
- `GET /api/v1/wallet/cards` - List credit cards
- `POST /api/v1/wallet/cards` - Add credit card
- `DELETE /api/v1/wallet/cards` - Remove credit card
- `GET /api/v1/wallet/points` - List point balances
- `PUT /api/v1/wallet/points` - Update point balance
- `DELETE /api/v1/wallet/points` - Remove point balance

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/aerobase-api.md (reported line 72)May include surrounding context.

md
- `DELETE /api/v1/wallet/cards` - Remove credit card
- `GET /api/v1/wallet/points` - List point balances
- `PUT /api/v1/wallet/points` - Update point balance
- `DELETE /api/v1/wallet/points` - Remove point balance
- `GET /api/v1/wallet/programs` - List loyalty programs
- `POST /api/v1/wallet/programs` - Add loyalty program
- `DELETE /api/v1/wallet/programs` - Remove loyalty program

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/aerobase-api.md (reported line 75)May include surrounding context.

md
- `DELETE /api/v1/wallet/points` - Remove point balance
- `GET /api/v1/wallet/programs` - List loyalty programs
- `POST /api/v1/wallet/programs` - Add loyalty program
- `DELETE /api/v1/wallet/programs` - Remove loyalty program
- `GET /api/v1/credit-cards` - Credit card transfer partners

### Recovery

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/aerobase-api.md (reported line 96)May include surrounding context.

md
### Saved Items
- `GET /api/v1/saved-items` - List saved items
- `POST /api/v1/saved-items` - Save an item
- `DELETE /api/v1/saved-items/{id}` - Remove saved item

### Itinerary
- `POST /api/v1/itinerary/plan` - Generate itinerary plan

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill is positioned as an all-in-one travel concierge with very broad capabilities, but it does not define clear invocation boundaries or explicit gating for high-risk actions. In an agentic environment, this can cause unintended activation for loosely related travel queries and may escalate into transactional actions like booking or cancellation without sufficiently narrow user intent.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md
- Base URL: `https://aerobase.app`
- Required env var: `AEROBASE_API_KEY`
- Auth header (preferred): `Authorization: Bearer ${AEROBASE_API_KEY}`
- Never ask users for passwords, OTPs, cookies, or third-party logins.
- Never print raw API keys in output; redact as `sk_live_***`.

### Request rules

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documentation advertises hotel prebooking, booking, and cancellation capabilities, but it does not clearly require confirmation before actions that can create, change, or cancel reservations or incur charges. In a travel concierge context, this is dangerous because an agent may execute irreversible or billable actions based on incomplete, inferred, or ambiguous user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The reference exposes numerous booking, payment, wallet, loyalty, and deletion endpoints without any accompanying guidance on confirmation requirements, sensitive-data handling, or least-privilege usage. In an agent skill context, this increases the chance that downstream tool implementations or prompts will invoke high-risk operations on behalf of a user without adequate consent or privacy safeguards.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.