ClawHub
Back to skill

Security audit

Airbnb calendar

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Airbnb availability integration, but users should handle its API key storage carefully.

Before installing, plan how you will store STAYINGAPI_KEY. Prefer a runtime secret store, OS keychain, or tightly permissioned secrets file; avoid committing it to dotfiles or logs, and use a sandbox key for testing when possible.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
references/auth-setup.md:7
Finding

Persistent Plaintext Storage of an API Credential

Content
View full analysis

Vulnerability Details

File Location: references/auth-setup.md, lines 7–10 and 29–32
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Vulnerable Documentation:

markdown
## Step 0 — how to store an env var on this system

Figure out the correct way to persist an environment variable on this machine so it is available in every future session (a shell profile, or a config/env file managed by your agent runtime). The variable name is `STAYINGAPI_KEY`.
bash
## Step 2 — store it

export STAYINGAPI_KEY="stay_live_…"   # or stay_test_… for the sandbox

Technical Analysis

The setup instructions direct the agent to persist STAYINGAPI_KEY across future sessions, potentially in a plaintext shell profile or agent-managed configuration file. The guidance does not require an operating-system keychain, runtime secret manager, owner-only file permissions, log redaction, shell-history protection, or periodic credential rotation.

Environment variables are not inherently secure storage. Persisting a live bearer credential in a broadly readable profile or configuration file may expose it to other local users, compromised processes, backup systems, diagnostic collection, or tools that inspect configuration files. Because the key is used directly as an authorization bearer token, possession may be sufficient to perform API operations attributed to the victim's account.

Attack Path

  1. A user or agent follows the setup guide and obtains a live StayingAPI key.
  2. The key is persisted in a shell profile or agent runtime configuration as instructed.
  3. The selected file has insufficient access restrictions, is included in backups, or is readable by another local process or user.
  4. An attacker extracts the plaintext STAYINGAPI_KEY.
  5. The attacker submits API requests using Authorization: Bearer <stolen-key>.
  6. Those requests are processed under the affected ...[truncated 561 chars]
Remediation
View remediation

Remediation Suggestions

  1. Store the credential in the agent runtime's dedicated secret manager or an operating-system keychain instead of a shell profile or general configuration file.
  2. Prefer session-scoped secret injection when cross-session persistence is not necessary.
  3. If file-backed storage is unavoidable, use a dedicated secrets file owned by the relevant account and restrict its permissions to owner read/write access.
  4. Ensure secret values are excluded from source control, backups where unnecessary, telemetry, command traces, debug output, and shell history.
  5. Avoid placing literal credentials directly in commands that may be recorded. Provide runtime-specific secure setup procedures instead.
  6. Document key revocation and rotation procedures, and recommend separate sandbox and live credentials with the minimum required privileges.
  7. Add explicit warnings that bearer credentials must never be printed, shared, committed, or included in support logs.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The guide explicitly tells users to persist an API key across future sessions in shell profiles or agent-managed config without any warning about plaintext secret storage, file permissions, multi-user systems, shell history, or use of a dedicated secret manager. That creates a real risk of credential disclosure through dotfile sync, backups, logs, shared environments, or other local compromise, especially because the same key grants access to the API and related services.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

Step 3 — verify

bash
curl -s "https://api.stayingapi.com/v1/account" -H "Authorization: Bearer $STAYINGAPI_KEY" | head

A 200 with your account envelope means the key works. A missing/invalid key returns 401 authentication_error (never billed). Full contract: https://api.stayingapi.com/openapi.json.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

Step 3 — verify

bash
curl -s "https://api.stayingapi.com/v1/account" -H "Authorization: Bearer $STAYINGAPI_KEY" | head

A 200 with your account envelope means the key works. A missing/invalid key returns 401 authentication_error (never billed). Full contract: https://api.stayingapi.com/openapi.json.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/auth-setup.md (reported line 34)May include surrounding context.

Step 3 — verify

bash
curl -s "https://api.stayingapi.com/v1/account" -H "Authorization: Bearer $STAYINGAPI_KEY" | head

A 200 with your account envelope means the key works. A missing/invalid key returns 401 authentication_error (never billed). Full contract: https://api.stayingapi.com/openapi.json.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/auth-setup.md (reported line 37)May include surrounding context.

Step 3 — verify

bash
curl -s "https://api.stayingapi.com/v1/account" -H "Authorization: Bearer $STAYINGAPI_KEY" | head

A 200 with your account envelope means the key works. A missing/invalid key returns 401 authentication_error (never billed). Full contract: https://api.stayingapi.com/openapi.json.

Static analysis

No suspicious patterns detected.