ClawHub
Back to skill

Security audit

Booking.com prices & cross-OTA comparison

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward StayingAPI integration for Booking.com price checks, with the main caution being ordinary API key handling.

Installers should treat STAYINGAPI_KEY like any paid-service credential: prefer a secret manager or agent-managed credential store, use a stay_test_ sandbox key for evaluation, avoid committing the key to dotfiles or repos, and rotate it if exposed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The guide explicitly tells users to persist the `STAYINGAPI_KEY` across future sessions but does not provide any cautions about secure secret storage, least-privilege handling, file permissions, or avoiding exposure in shared shell profiles and checked-in config files. This can lead to credential leakage through dotfiles, agent runtime configs, backups, logs, or multi-user systems, especially because the same key grants access to the API across multiple interfaces.

Static analysis

No suspicious patterns detected.