Security audit

Google Hotels — complete toolkit

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Google Hotels API integration, but users should handle the StayingAPI key as a sensitive secret.

Install only if you want an agent to query StayingAPI for hotel search and pricing. Use a sandbox key for testing, treat live keys as secrets, store them in a secure runtime secret store when possible, and avoid putting them in synced dotfiles, logs, or repositories.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The guide explicitly tells users to persist a long-lived API credential across future sessions and suggests shell profiles or runtime-managed config without warning that these locations may be readable by other users, exposed through backups, logs, dotfile sync, or accidental disclosure. While storing API keys is sometimes necessary, omitting secure-storage guidance increases the chance of credential leakage and unauthorized use of the StayingAPI account.

Static analysis

No suspicious patterns detected.