ClawHub
Back to skill

Security audit

Airbnb calendar

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent API helper for checking lodging availability, with an expected API key requirement and no hidden executable behavior.

Before installing, treat STAYINGAPI_KEY as a secret. Prefer the sandbox stay_test_ key for evaluation, store any live key in a secure agent/runtime secret store or a private environment file, avoid committing it to repositories, and rotate it if it may have been exposed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The document tells users to persist `STAYINGAPI_KEY` across future sessions but does not warn that this is a sensitive secret or limit storage to secure mechanisms. In agent or shared-shell environments, this can lead to long-lived credential exposure through shell profiles, config files, logs, backups, or other users/processes with access to the host.

Static analysis

No suspicious patterns detected.