ClawHub
Back to skill

Security audit

Airbnb prices & cross-OTA comparison

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward StayingAPI integration for checking Airbnb prices, with a disclosed API key requirement and no executable install code.

Installers should use a sandbox key first, store any live StayingAPI key in their agent runtime's secret store or another protected credential manager where possible, avoid committing it to dotfiles or repositories, and revoke or rotate it if exposed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The guide explicitly tells users to persist a live API key so it is available in every future session, but it does not warn about secure storage practices, least privilege, rotation, or the risk of exposing credentials through shell history, shared profiles, dotfiles, logs, or multi-user systems. Because the same key grants access to paid live API usage, insecure persistence can lead to credential theft, unauthorized requests, and billing abuse.

Static analysis

No suspicious patterns detected.