ClawHub
Back to skill

Security audit

Google Hotels prices & cross-OTA comparison

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward StayingAPI integration for hotel price lookup, with normal API-key handling and no hidden or destructive behavior found.

Install only if you are comfortable giving the agent access to your StayingAPI account for hotel price lookups. Prefer the sandbox stay_test_ key for evaluation, avoid committing the key to dotfiles or logs, and store any live key in the least-exposed credential mechanism your runtime supports.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The document explicitly instructs the user to persist `STAYINGAPI_KEY` across sessions in a shell profile or agent-managed config, but it does not warn that these locations may be readable by other local users, inherited by subprocesses, synced to dotfile repos, or exposed in logs and debugging output. Because this is an API credential for a third-party service, normalizing long-lived plaintext storage increases the chance of accidental disclosure and unauthorized API usage.

Static analysis

No suspicious patterns detected.