ClawHub
Back to skill

Security audit

Vrbo availability

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward StayingAPI/Vrbo availability skill, with the main caution being how users store the API key.

Before installing, treat STAYINGAPI_KEY as a sensitive API secret. Prefer a secure secret store or runtime-managed encrypted configuration, avoid committing it to dotfiles or shared repos, and use a sandbox stay_test_ key for evaluation when possible.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The guide tells users to persist `STAYINGAPI_KEY` across future sessions and suggests shell profiles or agent-managed config without warning that API keys are sensitive secrets that can be exposed through dotfiles, backups, process environments, shared machines, or overly broad runtime access. While this is common setup guidance, omitting secret-handling precautions increases the chance of accidental credential disclosure and misuse of the StayingAPI account.

Static analysis

No suspicious patterns detected.