ClawHub
Back to skill

Security audit

Booking.com hotels

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward hotel-search integration that discloses its StayingAPI network use and API-key requirement, with only a credential-storage caution to keep in mind.

Before installing, use a sandbox key for testing when possible, keep live keys out of version-controlled files and shared dotfiles, prefer an agent secret store or OS keychain if available, and rotate the key if it may have been exposed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The guide explicitly instructs users to persist a long-lived API key across future sessions in shell profiles or runtime-managed env files, but it does not warn about risks such as accidental exposure via dotfile sync, shared accounts, process inspection, backups, or inclusion in agent-readable config. In an agent skill context, encouraging durable credential storage increases the chance the key is later accessed by unrelated tools, leaked in logs, or reused beyond the user's intended scope.

Static analysis

No suspicious patterns detected.