ClawHub
Back to skill

Security audit

travel-hotel-research

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a travel research helper, but its executable API wrapper is broader than the advertised travel scope and can send arbitrary requests to Crawlora.

Review this before installing if you expect a narrowly scoped travel skill. It requires a Crawlora API key and sends your search terms and any provided JSON request bodies to Crawlora. The main concern is not hidden persistence or destructive behavior, but that the included helper can be reused for non-travel Crawlora endpoints unless the user or agent strictly limits how it is invoked.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding
The skill claims to be limited to travel and event research, but the described invocation pattern exposes a generic Crawlora API caller that can hit arbitrary endpoints and submit arbitrary POST bodies. That scope mismatch weakens user and platform trust boundaries: an agent may invoke broader data collection or unrelated services under the guise of a narrow travel skill, increasing the chance of policy bypass, unintended data access, or exfiltration to third-party endpoints.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The helper advertises and supports arbitrary Crawlora endpoints such as Amazon, YouTube, Google Search, and Google Trends, which materially exceeds the manifest’s narrow travel-hotel research scope. In an agent setting, this scope mismatch creates a confused-deputy risk: callers may repurpose the skill for unrelated data retrieval, expanding data exposure and bypassing intended capability boundaries.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The implementation accepts an arbitrary path and method, then forwards caller-controlled parameters and JSON bodies directly to the external API. Because the skill is supposed to perform travel-hotel research only, this broad proxy behavior enables web/search/transcript capabilities outside the declared purpose and increases the chance of unauthorized collection or transmission of unrelated data.

External Transmission

Medium
Category
Data Exfiltration
Content
curl -fsS -G "${auth[@]}" "${qs[@]}" "${base}${path}"
else
  [ -n "$body" ] || body="${rest[0]:-{}}"
  curl -fsS -X "$method" "${auth[@]}" \
    -H "Content-Type: application/json" -d "$body" "${base}${path}"
fi
Confidence
90% confidence
Finding
curl -fsS -X "$method" "${auth[@]}" \ -H "Content-Type: application/json" -d

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:24