Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed Booking.com/StayingAPI integration that sends travel search requests to StayingAPI using a user-provided API key, with no hidden scripts or destructive behavior found.
Install this if you want an agent to query StayingAPI for Booking.com and related lodging data. Use a sandbox key for evaluation, store live keys in a secure secret store when possible, and avoid sending sensitive trip details unless you are comfortable sharing them with StayingAPI and spending any applicable API credits.
The skill recommends using itself for essentially any Booking.com-related task, which can cause an agent to invoke a broad, networked integration even when a narrower or no tool would suffice. This increases the chance of unnecessary third-party data transmission, excess permissions/tool surface, and unintended actions on loosely related user requests.
The skill directs the agent to send requests to an external service using a bearer token, which creates a clear data egress path to a third party. If invoked with user-provided travel details or identifiers, sensitive itinerary and behavioral data may be transmitted outside the host environment, and compromise of the external service or key misuse could expose that data.
- **Authorization:** `Bearer $STAYINGAPI_KEY`
- **User-Agent:** your agent's name (e.g. `ClaudeCode/1.0`).
Base URL: `https://api.stayingapi.com/v1`.
## Tools
The guide explicitly tells users to persist an API key across future sessions, including shell profiles or agent-managed config, but does not warn that these locations may be readable by other local users, captured in backups, or exposed through logs and dotfile syncing. This increases the chance of credential leakage and long-lived compromise if the host or profile storage is not properly secured.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -s "https://api.stayingapi.com/v1/account" -H "Authorization: Bearer $STAYINGAPI_KEY" | head
A 200 with your account envelope means the key works. A missing/invalid key returns 401 authentication_error (never billed). Full contract: https://api.stayingapi.com/openapi.json.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -s "https://api.stayingapi.com/v1/account" -H "Authorization: Bearer $STAYINGAPI_KEY" | head
A 200 with your account envelope means the key works. A missing/invalid key returns 401 authentication_error (never billed). Full contract: https://api.stayingapi.com/openapi.json.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -s "https://api.stayingapi.com/v1/account" -H "Authorization: Bearer $STAYINGAPI_KEY" | head
A 200 with your account envelope means the key works. A missing/invalid key returns 401 authentication_error (never billed). Full contract: https://api.stayingapi.com/openapi.json.
No suspicious patterns detected.