ClawHub
Back to skill

Security audit

airbnb-reviews

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Airbnb review reader that uses a disclosed StayingAPI key and network API calls, with credential-storage guidance that users should handle carefully.

Use a sandbox key for evaluation when possible, store live keys in a secret manager or protected runtime config, avoid committing keys to repositories or synced dotfiles, and remember that listing URLs or ids are sent to StayingAPI when requesting reviews.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The guide explicitly tells users to persist an API key across future sessions, including via shell profiles or runtime-managed config, but does not warn about risks such as plaintext storage, accidental disclosure through dotfile sync/backups, overly broad file permissions, or reuse in shared environments. While this is common operational guidance, omitting secure-storage recommendations increases the chance of credential exposure and unauthorized API use.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.