ClawHub
Back to skill

Security audit

Vacation Rental Management

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real vacation-rental management integration, but it gives an agent broad authority over reservations, jobs, property records, credentials, and access details without enough guardrails.

Review this skill before installing. Use it only with a TIDY account and token you are comfortable granting broad property-management authority to, avoid sending permanent gate or lockbox codes unless strictly necessary, and require explicit human confirmation before cancellations, reschedules, deletes, or bulk changes.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:49
Finding

Unpinned Global Installation of a Third-Party CLI

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 49-52
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code Snippet:

bash
# Install
brew install tidyapp/tap/tidy-request    # or: npm i -g @tidydotcom/cli

Technical Analysis

The Skill directs users to install the tidy-request executable globally from a third-party Homebrew tap or npm package without pinning a reviewed version or verifying a cryptographic signature or checksum.

Consequently, the installed implementation is not fixed to the content reviewed in this Skill. A subsequent release, compromised publisher account, altered Homebrew formula, or compromised package-distribution channel could cause users to retrieve and execute different code while following the same instructions.

Global installation increases exposure because package installation logic and the resulting executable run with the privileges of the user performing the installation. The Skill subsequently expects this executable to access the TIDY_API_TOKEN environment variable or TIDY credential storage.

Attack Path

  1. An attacker compromises the npm publisher, Homebrew tap, upstream package, or another relevant distribution component.
  2. The attacker publishes a malicious release under the expected package name.
  3. A user follows the Skill instructions without specifying a version.
  4. Homebrew or npm resolves and installs the attacker-controlled release.
  5. Installation hooks or the installed CLI execute with the installing user's privileges.
  6. The malicious dependency can read resources available to that user, including the TIDY token when the CLI is invoked, and transmit or misuse them.

Impact Assessment

Successful exploitation could provide code execution with the privileges of the user who installs or invokes the CLI. Depending on local permissions, this could expose the TIDY API token, property addresses, acces ...[truncated 280 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the CLI to a specifically reviewed version rather than installing the latest available release.
  • Publish and verify cryptographic checksums or signatures for the package and Homebrew artifacts.
  • Document the authoritative package publisher and repository so users can verify provenance.
  • Avoid global installation where practical; use an isolated environment or restricted package execution mechanism.
  • Disable or review npm lifecycle scripts when the installation process permits it.
  • Run the CLI under a dedicated, least-privileged account or sandbox with access only to required resources.
  • Establish an update-review process before recommending newer dependency versions.

T09 · Insecure Skill Coding Practices

Error
Location
references/authentication.md:50
Finding

Indefinite Bearer Tokens with Unspecified Credential-File Protections

Content
View full analysis

Vulnerability Details

File Location: references/authentication.md, lines 50-61
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: High

Vulnerable Code Snippet:

markdown
## Token Storage

**Environment variable (recommended):**

```bash
export TIDY_API_TOKEN="abc123..."

The CLI (tidy-request) reads TIDY_API_TOKEN automatically. If not set, credentials are stored in ~/.config/tidy/credentials after running tidy-request login or tidy-request signup.

Token Lifecycle

  • Tokens do not expire
  • Logging in again returns a new token (previous tokens remain valid)
  • Store your token securely — treat it like a password
text

### Technical Analysis

The documented authentication design uses bearer tokens that do not expire, and obtaining a new token does not invalidate previously issued tokens. Any party possessing such a token can use it as the account holder until an independent revocation mechanism is applied.

The CLI may store credentials at `~/.config/tidy/credentials`, but the documentation does not specify encryption, operating-system credential-manager integration, restrictive file permissions, token scoping, rotation, or a revocation procedure. Environment variables can also be exposed to processes, diagnostics, shell history when set unsafely, or process-management tooling depending on the operating environment.

This behavior exceeds ideal least-privilege credential practice because a single long-lived token appears to authorize the broad authenticated API surface required by the Skill rather than a limited set of properties or operations.

### Attack Path

1. A malicious dependency, compromised user process, local attacker, backup exposure, or accidental diagnostic output obtains `TIDY_API_TOKEN` or reads the CLI credential file.
2. The attacker submits the token as an `Authorization: Bearer` credential to `https://public-api.tidy.com`.
3. Because
...[truncated 1234 chars]
Remediation
View remediation

Remediation Suggestions

  • Replace indefinite bearer tokens with short-lived access tokens and securely managed refresh tokens.
  • Revoke or rotate prior tokens when a user logs in again, changes credentials, or reports suspected compromise.
  • Provide an explicit token inventory and revocation interface.
  • Introduce narrowly scoped tokens for read-only access, booking management, property management, and other distinct capabilities.
  • Support property-specific or operation-specific authorization where practical.
  • Store credentials in the operating system's secure credential manager rather than an ordinary configuration file.
  • If file storage is unavoidable, require owner-only permissions, validate permissions before use, and document the exact storage protections.
  • Avoid returning raw tokens in Agent-visible MCP output or logs.
  • Redact bearer tokens from diagnostics, command output, telemetry, and error reports.
  • Warn users before transmitting property-entry secrets and recommend temporary, service-specific access codes instead of permanent gate or lockbox codes.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (23)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
94% confidence
Finding

The documented DELETE operation enables direct deletion of guest reservations by identifier, and the skill does not describe safeguards such as ownership checks, confirmation prompts, or immutable previews before execution. In an agentic workflow, parameter confusion, stale context, or prompt manipulation could lead to deletion of the wrong reservation and cascading operational failures like missed turnovers or guest disruption.

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

tidy-request "Cancel the reservation at 789 Pine St for April 5"

text

REST: `DELETE /api/v2/guest-reservations/:id`

### Handle Changes

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
86% confidence
Finding

A delete-address endpoint can permanently remove property records and potentially disrupt downstream bookings, checklists, and turnover workflows if misused. In an agent-driven skill, broad parameterized deletion without documented confirmation, authorization scoping, or safety constraints increases the risk of accidental or prompt-induced destructive actions.

Content

Scanner excerpt · references/rest-api-reference.md (reported line 123)May include surrounding context.

Delete Address

text
DELETE /api/v2/addresses/:address_id

Active jobs must be cancelled first.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
84% confidence
Finding

Deleting guest reservations is a sensitive operation that can cause service disruption, missed turnovers, guest impact, and operational confusion if triggered incorrectly. Because the endpoint is simple and destructive, an LLM-integrated workflow could misuse it from ambiguous instructions or incorrect ID selection.

Content

Scanner excerpt · references/rest-api-reference.md (reported line 247)May include surrounding context.

Delete Reservation

text
DELETE /api/v2/guest-reservations/:guest_reservation_id

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
82% confidence
Finding

Task deletion can erase maintenance or incident records, undermining accountability and causing operational issues, especially if tasks track safety or property problems. In an agentic environment, a bare delete endpoint without guardrails can be abused through incorrect task IDs or prompt-driven bulk cleanup actions.

Content

Scanner excerpt · references/rest-api-reference.md (reported line 290)May include surrounding context.

Delete Task

text
DELETE /api/v2/tasks/:task_id

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill delegates broad free-form natural-language requests to an external service without defining hard scope boundaries or requiring confirmation for sensitive operations. In a real agent setting, ambiguous or prompt-influenced instructions could cause unintended actions such as creating, modifying, or cancelling reservations and jobs across properties.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill includes examples for cancellation and rescheduling of live reservations and turnover cleans but does not require an explicit warning or user confirmation before performing those state-changing operations. This increases the risk of accidental operational disruption, especially when the agent is acting on natural-language input or incomplete context.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The manifest describes a skill for managing reservations, turnovers, and cleaning schedules for vacation rentals. This file documents creating and authenticating arbitrary TIDY accounts via external API endpoints and persistent token handling, which is broader behavior than the stated operational management scope and introduces a separate account-management surface not mentioned in the manifest.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
80% confidence
Finding

Signing up new accounts is distinct from managing rental cleanings and reservations. While authenticated API access may be expected, exposing account-registration capability is not an obvious requirement of the manifest's stated purpose and is not explicitly declared there.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/authentication.md (reported line 8)May include surrounding context.

Sign Up (New Account)

bash
curl -X POST https://public-api.tidy.com/api/v2/auth/signup \
  -H "Content-Type: application/json" \
  -d '{
    "first_name": "Jane",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The guide states that credentials may be stored in ~/.config/tidy/credentials but does not warn about the security implications of persistent on-disk storage or specify required file permissions. Long-lived non-expiring bearer tokens stored locally increase the risk of token theft from shared machines, backups, or malware, leading to unauthorized access to the user's TIDY account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The login tool collects raw email and password and sends them to a third-party remote MCP endpoint, but the documentation does not prominently warn users that their credentials are being transmitted off-platform. This can lead to credential disclosure without informed consent, especially in agent contexts where users may assume secrets remain local or are handled by the host application.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documented MCP surface includes account creation, login, and a generic freeform action channel that can perform requests beyond the narrow turnover/cleaning workflow described in the skill metadata. This creates a scope mismatch: an agent or user may grant credentials or issue broad natural-language commands to a remote service with capabilities not clearly bounded by the advertised skill purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

message_tidy sends freeform natural-language requests and optional contextual identifiers such as address, booking, issue, and reservation IDs to an external service, yet the documentation omits a clear disclosure of that data flow. In a vacation-rental context, these messages may contain guest details, property information, operational notes, or other sensitive business data, increasing privacy and data-governance risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest describes a skill focused on vacation rental turnovers, guest reservations, cleaning schedules, and checklists. This reference documents additional capabilities such as account signup/login, adding service professionals, generic natural-language messaging, and general issue/task management that extend beyond the stated operational scope and are not clearly tied to turnover scheduling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The natural-language endpoint invites submission of arbitrary freeform text and optional context objects, but the docs do not warn that sensitive guest, access, or operational data may be transmitted to an external service. In this skill context, users may include door codes, reservation details, and personally identifiable information, creating privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The documentation exposes a destructive delete operation for property addresses without highlighting its irreversible data impact or recommending confirmation safeguards. In an agentic setting, omission of such warnings can lead to accidental destructive actions when an LLM or operator issues broad or ambiguous commands.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/rest-api-reference.md (reported line 171)May include surrounding context.

Example:

bash
curl -X POST https://public-api.tidy.com/api/v2/jobs \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/rest-api-reference.md (reported line 226)May include surrounding context.

Example:

bash
curl -X POST https://public-api.tidy.com/api/v2/guest-reservations \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

bash
# 1. Create the reservation
curl -X POST https://public-api.tidy.com/api/v2/guest-reservations \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/vacation-workflows.md (reported line 34)May include surrounding context.

bash
# 1. Create the reservation
curl -X POST https://public-api.tidy.com/api/v2/guest-reservations \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The MCP example shows direct handling of credentials and tokens without any warning about secret management, which can normalize unsafe copy-paste patterns and accidental exposure in shells, chat logs, or documentation screenshots. Although the password is redacted, the example still encourages authentication flows that may leak reusable secrets if followed carelessly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The workflow examples explicitly include highly sensitive physical access details such as gate codes, lockbox codes, and key locations in requests sent to the service. This creates a real risk of unnecessary exposure of secrets that could enable unauthorized entry if logs, prompts, screenshots, or third-party systems are compromised.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The text states message_tidy is the "primary tool — use it for everything," yet the same reference provides separate login, signup, get_message_tidy, and list_messages_tidy tools with their own required usage patterns. This is an active documentation contradiction about intended interaction flow, not merely an omission.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.