ClawHub
Back to skill

Security audit

Booking.com Hotels

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward hotel-search integration that uses a StayingAPI key to query StayingAPI for Booking.com hotel results.

Before installing, use a sandbox key for testing where possible and store any live StayingAPI key in your agent or OS secret store if available. If you persist it in shell or runtime config files, keep those files private, avoid committing them, and rotate the key if it may have been exposed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The document explicitly tells users to persist `STAYINGAPI_KEY` across sessions in shell profiles or runtime-managed env files, but it provides no guidance on secure storage, file permissions, secret managers, or the risk of accidental exposure through dotfiles, process environments, logs, or shared machines. While storing API keys in environment variables is common, instructing persistence without safeguards increases the chance of credential leakage and misuse.

VirusTotal

59/59 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.