ClawHub
Back to skill

Security audit

Google Hotels

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Google Hotels browser-automation helper with some optional deal-checking and install-supply-chain cautions, but no evidence of hidden persistence, credential theft, destructive actions, or booking completion.

Install from a pinned or trusted source when possible rather than relying on the mutable README npx command. When using the skill, expect it to browse Google Hotels and, if you agree to deal checking, hotel or chain websites; do not provide payment details or allow it to complete a booking.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:7
Finding

Unpinned Third-Party Installer and Mutable Remote Source

Content
View full analysis

Vulnerability Details

File Location: README.md, line 7
Vulnerability Type: Unpinned third-party dependency and mutable installation source
Risk Level: Medium

Vulnerable Code

bash
npx skills add https://github.com/skillhq/hotel-search

Technical Analysis

The documented installation command invokes npx skills without specifying a package version or integrity digest. Consequently, the command may download and execute whichever package version the npm registry resolves at installation time.

The command also installs skill content from a mutable GitHub repository reference rather than an audited commit hash or signed release. The effective installer and installed content can therefore change after this audit without any modification to the reviewed project files.

This creates two supply-chain trust boundaries:

  1. The npm package resolved for skills can change or be compromised.
  2. The default branch or repository content at the GitHub URL can change or be compromised.

Because npx executes the resolved package, compromise of the package, maintainer account, registry entry, repository, or associated credentials could turn the installation command into a local code-execution path.

Attack Path

  1. An attacker compromises the npm package resolved by npx skills, its publisher account, or the referenced GitHub repository.
  2. The attacker publishes malicious installer logic or modifies the repository’s default branch.
  3. A user follows the installation command from README.md.
  4. npx downloads and executes the currently resolved package rather than a version verified during this audit.
  5. The installer retrieves the mutable repository content and installs it.
  6. Malicious package logic may execute during installation, or attacker-controlled skill instructions may run when the installed skill is later activated.

Impact Assessment

Successful exploitation could execute code with the privileges of the user running t ...[truncated 513 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the npm package to a reviewed version, for example by using an exact version rather than an unqualified package name.
  2. Pin the GitHub source to a specific audited commit hash or immutable signed release tag.
  3. Use npm lockfile and integrity metadata where installation architecture permits.
  4. Publish signed releases and document how users can verify signatures or checksums before installation.
  5. Avoid executing newly downloaded installer code directly where possible. Prefer a download, verification, review, and activation workflow.
  6. Document the exact package version and repository commit covered by each security review.
  7. Protect package and repository maintainer accounts with phishing-resistant multi-factor authentication and restricted release permissions.
  8. Run installation under a non-privileged account and avoid using sudo or administrator privileges.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The README instructs users to install the skill via npx skills add https://github.com/skillhq/hotel-search without pinning a specific commit, tag, or immutable package version. This creates a supply-chain risk because future changes to the referenced installer or repository content could cause users to fetch and trust different code than originally reviewed.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger list includes broad travel-related phrases such as 'where to stay,' 'hotel near,' and 'book a hotel,' which can overlap with ordinary conversation and adjacent intents. Overbroad activation increases the risk that the skill runs in contexts the user did not specifically intend, especially given the skill’s browser automation and expanded post-search navigation behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documentation says the skill 'searches only' and should never complete a purchase, but later instructs the agent to visit hotel websites and inspect direct-booking offers. This inconsistency can cause policy confusion and operational drift, making it more likely the agent will perform actions outside the user’s expectations or outside the intended safety envelope.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill’s stated purpose is Google Hotels search, but this section expands the workflow into visiting third-party hotel websites and checking promotions, rates, and booking flows. That broadens both the browsing scope and the trust boundary, increasing the chance of unintended navigation, exposure to more complex pages, and accidental drift toward transactional actions the skill claims not to perform.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documented workflow materially expands the skill from Google Hotels result retrieval into browsing hotel-owned sites, chain booking engines, and general web searches for deals and promo codes. That scope expansion increases data exposure to third-party services and can lead the agent to perform actions outside the user’s reasonable expectation for a Google Hotels search skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Open-web promo-code and coupon discovery is not necessary to fulfill the stated purpose of searching Google Hotels, and it introduces unrelated browsing to arbitrary external pages. This can expose user travel intent and increase the risk of unsafe or misleading third-party content being visited under the guise of a hotel search workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The third-party browsing guidance lacks any warning that visiting hotel sites, chain booking engines, or Google searches can disclose user destination, dates, and lodging interest to external services. In a travel context, those details can be sensitive, so failing to warn or obtain consent weakens privacy safeguards even if no direct booking occurs.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.