ClawHub
Back to skill

Security audit

Google Hotels — Complete Toolkit

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Google Hotels/StayingAPI API guide, with the main caution being how the API key is stored.

Before installing, use a sandbox key when testing and store any live StayingAPI key in your agent or OS secret manager when available. Avoid committing it to repositories or syncing it through dotfiles, and rotate the key if it may have been exposed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The document explicitly instructs users to persist the `STAYINGAPI_KEY` across future sessions but does not include guidance on secure storage, least-privilege handling, filesystem permissions, or the risks of placing secrets in shell profiles and other long-lived plaintext locations. This can lead to credential exposure through dotfile syncing, backups, shared accounts, process inspection, or accidental check-in to repositories, especially because the same key is described as usable across multiple services.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.