ClawHub
Back to skill

Security audit

Google Hotels cross-OTA comparison

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed StayingAPI hotel price comparison integration that needs an API key and network access, with no hidden or unrelated behavior found.

Install only if you are comfortable sending hotel/property, location, date, and occupancy queries to StayingAPI and storing a StayingAPI key for agent use. Prefer the sandbox stay_test_ key for evaluation and use a trusted secret manager or runtime environment setting for live keys.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Transmission

Medium
Category
Data Exfiltration
Content
## Credits

Number-free by design — **failed, empty and blocked calls are never billed**, and `stay_test_` sandbox calls are always free. Current costs: <https://stayingapi.com/pricing> · full contract: <https://api.stayingapi.com/openapi.json>.

## Trademark
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.