ClawHub
Back to skill

Security audit

Airbnb availability

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward StayingAPI integration for checking Airbnb availability, with a minor caution around how it tells users to persist an API key.

Before installing, treat STAYINGAPI_KEY as a secret. Prefer a sandbox key for testing, store live keys only in a trusted secret store or restricted-permission env file, and avoid putting the key in shared shell profiles, logs, command history, or version control.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The document instructs users to persist `STAYINGAPI_KEY` across future sessions, including shell profiles or runtime-managed env files, but does not warn that these locations store long-lived credentials on disk and may be readable by other users, processes, backups, or support tooling. Because the key authorizes API access and potentially billable live requests, encouraging persistent storage without minimal handling guidance increases the chance of credential leakage or accidental exposure.

Static analysis

No suspicious patterns detected.