ClawHub
Back to skill

Security audit

Booking.com Availability

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Booking.com availability checker that uses a disclosed StayingAPI key and network API calls, with one credential-storage hardening note.

Before installing, treat STAYINGAPI_KEY like any API secret. Prefer a runtime secret store or OS keychain when available, use the sandbox key for testing, avoid placing live keys in shared or world-readable files, and rotate the key if it may have been exposed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The document explicitly tells users to persist `STAYINGAPI_KEY` across sessions and suggests putting it in a shell profile or agent-managed config, but it does not warn about least-privilege storage, file permissions, secret-scoped storage, or the risk of exposing long-lived credentials to other local users, logs, or subprocesses. In an agent-skill context, persistent environment variables are often broadly inherited by future sessions and tools, which increases the blast radius if the host or runtime is later compromised.

VirusTotal

59/59 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.