ClawHub
Back to skill

Security audit

Google Hotels availability

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward StayingAPI skill for checking Google Hotels availability, with the main caution being ordinary API-key handling.

Before installing, be prepared to provide a StayingAPI key. Use a sandbox key for evaluation where possible, avoid committing the key to dotfiles or repositories, and prefer your agent runtime's secret storage or another protected secret manager for live keys.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The document explicitly tells users to persist `STAYINGAPI_KEY` across future sessions in shell profiles or runtime-managed config without any guidance on secure storage, file permissions, secret managers, or risks of plaintext credential exposure. That can lead to accidental disclosure through dotfile sync, backups, shared systems, process inspection, or repository commits, especially because the key enables access to an external API account.

Static analysis

No suspicious patterns detected.