ClawHub
Back to skill

Security audit

Vrbo prices & cross-OTA comparison

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent StayingAPI/Vrbo price integration, but its setup guide tells agents to persist an API key broadly across future sessions without clear secret-storage safeguards or user confirmation.

Review before installing. Use a sandbox key for testing, prefer an agent/runtime secret store or session-scoped environment injection over shell-profile persistence, and avoid storing a live StayingAPI key in plaintext files that unrelated processes or backups may read.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
references/auth-setup.md:5
Finding

Persistent Storage of a Plaintext API Credential

Content
View full analysis

Vulnerability Details

File Location: references/auth-setup.md:5-9, 29-31 (referenced by SKILL.md:27)
Vulnerability Type: Plaintext credential persistence and excessive credential exposure
Risk Level: Medium

Vulnerable Code Snippet

markdown
## Step 0 — how to store an env var on this system

Figure out the correct way to persist an environment variable on this machine so it is available in every future session (a shell profile, or a config/env file managed by your agent runtime). The variable name is `STAYINGAPI_KEY`.
bash
export STAYINGAPI_KEY="stay_live_…"   # or stay_test_… for the sandbox

The persistence procedure is invoked by the following instruction in SKILL.md:27:

markdown
If `$STAYINGAPI_KEY` is not set, read [references/auth-setup.md](references/auth-setup.md) and follow it to get and store the key.

Technical Analysis

The setup guide directs the agent to persist STAYINGAPI_KEY in a shell profile or runtime-managed environment file so that it remains available in future sessions. It does not require use of an operating-system or runtime secret manager, restrictive file permissions, encryption at rest, limited process exposure, or explicit user approval before modifying persistent configuration.

Environment variables exported from a shell profile can be inherited by unrelated child processes. A key stored in a plaintext profile or environment file may also be exposed through backups, diagnostic bundles, accidental repository commits, terminal or automation logs, and any local process or user that can read the relevant file. The example does not itself contain a real key, but it encourages users or agents to substitute and persist a live credential.

Attack Path

  1. The skill is invoked while STAYINGAPI_KEY is unset.
  2. The agent follows SKILL.md:27 and opens the authentication setup guide.
  3. The user obtains a live StayingAPI key and the agent ...[truncated 1195 chars]
Remediation
View remediation

Remediation Suggestions

  1. Store the credential in an operating-system keychain, secrets manager, or the agent runtime's protected secret facility instead of a shell profile.
  2. Prefer session-scoped credential injection when persistent access is unnecessary.
  3. Require explicit user confirmation before writing any credential to persistent storage.
  4. If a credential file is unavoidable, use a dedicated file outside the repository, restrict permissions to the owning user, and ensure it is excluded from version control, backups, logs, and diagnostic exports where practical.
  5. Avoid exposing the key to unrelated child processes; inject it only into the process that communicates with StayingAPI.
  6. Document procedures for key rotation and immediate revocation after suspected disclosure.
  7. Recommend sandbox keys for evaluation and live keys only when real data is required.
  8. Replace the generic persistence instruction with platform-specific, least-privilege guidance that verifies storage permissions without printing the credential.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

Step 3 — verify

bash
curl -s "https://api.stayingapi.com/v1/account" -H "Authorization: Bearer $STAYINGAPI_KEY" | head

A 200 with your account envelope means the key works. A missing/invalid key returns 401 authentication_error (never billed). Full contract: https://api.stayingapi.com/openapi.json.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

Step 3 — verify

bash
curl -s "https://api.stayingapi.com/v1/account" -H "Authorization: Bearer $STAYINGAPI_KEY" | head

A 200 with your account envelope means the key works. A missing/invalid key returns 401 authentication_error (never billed). Full contract: https://api.stayingapi.com/openapi.json.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/auth-setup.md (reported line 34)May include surrounding context.

Step 3 — verify

bash
curl -s "https://api.stayingapi.com/v1/account" -H "Authorization: Bearer $STAYINGAPI_KEY" | head

A 200 with your account envelope means the key works. A missing/invalid key returns 401 authentication_error (never billed). Full contract: https://api.stayingapi.com/openapi.json.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/auth-setup.md (reported line 37)May include surrounding context.

Step 3 — verify

bash
curl -s "https://api.stayingapi.com/v1/account" -H "Authorization: Bearer $STAYINGAPI_KEY" | head

A 200 with your account envelope means the key works. A missing/invalid key returns 401 authentication_error (never billed). Full contract: https://api.stayingapi.com/openapi.json.

Static analysis

No suspicious patterns detected.