Urban Sports Club Booking API

ReviewAudited by ClawScan on May 1, 2026.

Overview

The skill matches its stated Urban Sports Club scanning and booking purpose, but it handles your USC password locally and can book or cancel classes when invoked.

This appears to be a coherent, purpose-aligned USC booking helper. Before installing, be comfortable storing your USC email/password in a local JSON file and letting the script book or cancel classes when you invoke those commands. Use an isolated Python environment and double-check class IDs before booking or cancellation.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI03: Identity and Privilege Abuse

What this means

Installing and using the booking features requires trusting the skill with your USC account password and account access.

Why it was flagged

The code reads a local credentials.json file and enters the stored email/password into the Urban Sports Club login form.

Skill content

creds_path = Path(__file__).parent / "credentials.json" ... await page.locator('input[name="email"]:visible').fill(creds["email"])

Recommendation

Use a private local credentials file, protect or delete it when not needed, and only run booking-related commands when you intend to use your USC account.

Medium

#ASI02: Tool Misuse and Exploitation

What this means

If run with the wrong class ID, the skill could book or cancel the wrong Urban Sports Club class.

Why it was flagged

The script can click the website controls that book a class or confirm cancellation after it is invoked with a class ID.

Skill content

await book_btn.first.click() ... await confirm_btn.first.click()

Recommendation

Confirm the class ID, date, venue, and time before invoking --book or --cancel, and consider requiring explicit user confirmation in any agent workflow.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Setup may download and install third-party software on the local machine.

Why it was flagged

The setup instructions install an unpinned Python package and browser dependencies, which is expected for Playwright but pulls code and binaries from external package sources.

Skill content

venv/bin/pip install playwright
venv/bin/playwright install chromium
venv/bin/playwright install-deps chromium

Recommendation

Install in a virtual environment, prefer pinned versions if you adapt the skill, and review dependency sources before installing.