ClawHub
Back to skill

Security audit

Booking.com availability

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Booking.com availability checker that uses a disclosed StayingAPI key and network API access.

Use a sandbox key for testing when possible. If using a live StayingAPI key, store it in your runtime's secure secret storage rather than a synced or shared shell profile, and revoke the key if it is accidentally exposed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The document explicitly instructs the user or agent to persist `STAYINGAPI_KEY` so it survives across sessions, but it does not warn that this may store a live secret in shell profiles, env files, or agent-managed configuration on disk. Persistent credential storage increases the chance of accidental disclosure through dotfile syncing, logs, backups, shared hosts, or later agent access beyond the original task scope.

Static analysis

No suspicious patterns detected.