tripclaw

PassAudited by ClawScan on May 10, 2026.

Overview

This skill does what it says—imports a user-provided trip to TripClaw via an API key—but users should review the trip data and protect the API key before syncing.

Before installing, confirm that api.tripclaws.com is the correct TripClaw API endpoint, keep your API key private, and ask the agent to show the itinerary JSON before importing. Avoid putting secrets or highly sensitive travel details on the command line when possible.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

If the agent sends incorrect generated data, that trip may be saved to the user's TripClaw account.

Why it was flagged

The included tool performs a POST to create/import trip data in the external TripClaw service. This is expected for the skill, but it is an account-changing action.

Skill content

API_BASE_URL = "https://api.tripclaws.com"
API_ENDPOINT = "/v1/trips/import"
...
method="POST"

Recommendation

Preview or validate the trip JSON before import, and use the script's validate-only mode when unsure.

Low

#ASI03: Identity and Privilege Abuse

What this means

Anyone who obtains the API key may be able to act on the user's TripClaw account within that key's permissions.

Why it was flagged

The script uses a bearer API key to authenticate to TripClaw. This is purpose-aligned, but the key is sensitive delegated account authority.

Skill content

"Authorization": f"Bearer {api_key}"

Recommendation

Store the key in a local environment variable or secure config, avoid sharing it, prefer scoped/revocable keys if available, and rotate it if exposed.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Personal travel plans and related details will be shared with TripClaw when syncing.

Why it was flagged

The skill explicitly sends itinerary data, including locations, accommodations, activities, and budget, to an external provider API.

Skill content

支持将行程数据（途经点、住宿、活动、预算等）通过 API 同步到用户的 TripClaw 账户。

Recommendation

Only sync data you are comfortable storing in TripClaw, and confirm the destination API endpoint is the one you intend to use.

Info

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

It is harder for a user to independently confirm that the skill and API endpoint are officially associated with TripClaw.

Why it was flagged

The registry metadata does not provide an upstream source or homepage for verifying the publisher or official TripClaw integration.

Skill content

Source: unknown
Homepage: none

Recommendation

Install only if you trust the publisher, and verify the TripClaw API endpoint and API-key instructions through an official channel.