Travelkit
ReviewAudited by ClawScan on May 15, 2026.
Overview
This looks like a coherent TravelKit flight-booking skill, but it can use TravelKit account credentials, collect passenger identity details, and perform confirmed booking or payment actions.
Before installing, verify that you trust the TravelKit service and publisher, configure credentials securely, and pay close attention to confirmation prompts before any booking, payment, cancellation, refund, or change.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If you confirm an action, the agent may create, pay for, cancel, refund, or change a flight order.
These tools can change bookings or trigger payments, but the skill explicitly treats them as write operations that require user confirmation.
Create order, pay, cancel, refund request/confirm, and change request are write operations; get explicit user confirmation for the exact action first.
Only confirm after the agent restates the exact flight, passenger, order number, payment method, amount, and consequence you intend.
A TravelKit API key could allow actions on the connected TravelKit account according to its permissions.
The skill relies on a TravelKit bearer token/API key for delegated access to the remote MCP service; this is expected for the integration but grants privileged account access.
Authorization: Bearer {TRAVELKIT_API_KEY}Use an official, least-privileged TravelKit key, store it as a secret, and revoke or rotate it if it is exposed.
Passenger document numbers, contact details, and order information may be sent to TravelKit as part of creating or managing bookings.
The booking workflow collects sensitive passenger identity and contact details that are used with TravelKit order tools; this is normal for flight booking but sensitive.
Every passenger must have phone, email, document type, and document number.
Provide only the passenger details needed for the booking, and use the skill only if you trust the TravelKit MCP service and account configuration.