ClawHub
Back to skill

Security audit

Hotel Booking AI

Security checks across malware telemetry and agentic risk

Overview

This hotel-booking skill is mostly purpose-aligned, but it stores and reuses a persistent login key while sending booking/auth data to a plain HTTP API.

Review before installing. Only use this in a private environment, delete user_key.txt when finished or when switching users, avoid shared machines, and be aware that the documented API sends the key and booking details over plain HTTP. Do not run the booking evals against a live account unless you intend to create real reservations.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The documentation instructs the agent to retrieve a persistent `user_key`, store it locally in `{baseDir}/user_key.txt`, and inject it automatically on every tool call. For a hotel-booking skill, this expands behavior beyond booking data handling into credential collection and persistence, increasing the risk of token theft, misuse across sessions, or unauthorized API actions if the local environment is compromised.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The skill documentation introduces an external dashboard login flow and manual copying of a `user_key`, which is not obviously necessary from the stated hotel-booking function alone. This creates a phishing-like trust boundary expansion: users may be conditioned to visit external sites and provide credentials or tokens outside the normal skill flow, exposing them to account compromise or token leakage.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The eval explicitly instructs the agent to 'create a booking' after checking availability, but it does not constrain execution to a sandbox, test tenant, or dry-run flow. In a hotel-booking skill with live prices, availability, order management, and payment capabilities, this ambiguity can cause automated evaluation runs to create real reservations using supplied PII, leading to unauthorized transactions or operational harm.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The documentation describes storing a sensitive `user_key` locally for future sessions without any warning about persistence, local file exposure, revocation, or shared-device risks. Even if the key is legitimate, silent long-term storage of reusable credentials materially raises the chance of unauthorized reuse by other local users, malware, backups, or logs.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
2. If the file **does not exist or is empty** — do NOT call any API. Tell the user:
   > "Before we start, I need to verify your identity. Please visit https://aauth-170125614655.asia-northeast1.run.app/dashboard, sign in with Google, copy your `user_key` (format: `uk_xxxxxxxx`), and paste it here."
   When the user provides it, save it to `{baseDir}/user_key.txt` and continue.
3. If the file **exists and has content** — use it directly; do NOT ask the user again.
4. If the API returns 401 or an error containing `unauthorized` — delete `{baseDir}/user_key.txt` and repeat step 2.

---
Confidence
91% confidence
Finding
do NOT ask the user

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.