ClawHub
Back to skill

Security audit

Google Hotels search

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Google Hotels search integration that uses a StayingAPI key, with a minor credential-storage caution for users.

Before installing, use a sandbox key for testing where possible. Store any live StayingAPI key in a secure credential store or protected agent config, avoid committing it to a repository, and rotate the key if it may have been exposed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The guide explicitly tells users to persist `STAYINGAPI_KEY` across future sessions in shell profiles or agent-managed config without warning that these locations may be readable by other users, exposed in backups, inherited by subprocesses, or accidentally committed. Because this is an authentication secret for a live API, insecure persistence increases the chance of credential leakage and unauthorized API usage.

Static analysis

No suspicious patterns detected.