ClawHub
Back to skill

Security audit

vrbo-availability

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Vrbo availability checker that uses a disclosed StayingAPI key and external API calls, with one credential-storage caution for users.

Install only if you are comfortable sending Vrbo listing IDs, URLs, and date windows to StayingAPI. Prefer the sandbox key for testing, store live keys in your agent runtime's secret manager or another secure store when available, and rotate or revoke the key if it may have been exposed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The document explicitly tells users to persist `STAYINGAPI_KEY` across future sessions but does not provide any guidance on secure storage, least-privilege handling, rotation, or avoiding exposure in shared shells and profile files. Long-term credential persistence increases the chance of accidental disclosure through shell history, dotfile syncing, backups, multi-user access, or agent/runtime logs.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.