ClawHub
Back to skill

Security audit

Hotel Price Finder - Multi OTA

Security checks for vulnerabilities and agentic risk

Overview

This hotel-price skill uses external travel APIs for its stated purpose and shows no hidden persistence, local file access, or destructive behavior.

Before installing, understand that hotel destinations, dates, room counts, and related search details may be sent to travel providers. Avoid using the optional Apify mode unless you are comfortable with the API key handling, and prefer pinned installer versions when available.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
README.md:28
Finding

Unpinned npm Package Execution

Content
View full analysis
Remediation
View remediation
install hotel-price-finder ``` - Where supported, verify the package archive against a published cryptographic checksum or signature. - Document the expected npm registry and package publisher identity. - Advise users not to run the installation command with administrative privileges. - Use lockfiles and integrity metadata wherever the installation workflow supports them. - Establish a release-review process before updating the documented version. ]]>

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:77
Finding

Apify API Token Exposed in Command-Line URL

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The README instructs users to execute npx clawhub@latest install hotel-price-finder, which pulls and runs the latest published version of a package at install time rather than a pinned, reviewed version. If the upstream package is compromised, typosquatted, or publishes a malicious update, users may execute attacker-controlled code on their machine during installation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The activation condition is broad enough to trigger on general travel conversation or accommodation recommendations, causing the skill to run and send user travel details to external services without a clear, explicit request. In this skill, that over-triggering risk is amplified because activation can immediately lead to third-party lookups using destination and date data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill instructs the agent to transmit user-supplied travel queries, including destination and potentially dates, to third-party services without an explicit user-facing disclosure or consent step. Travel itinerary data can be sensitive, and silent sharing with multiple providers increases privacy and data-handling risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The skill sends user destination queries to Xotelo for location resolution, which is an external transmission of user travel intent to a third party. In context, this becomes risky because the skill lacks any explicit warning or consent flow before sharing the query externally.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

Xotelo uses TripAdvisor keys (g{number}). For unlisted cities, call:

bash
curl -s "https://data.xotelo.com/api/search?q=DESTINATION&limit=5"

Common keys: Seoul=g294197, Busan=g297884, Jeju=g983296, Tokyo=g298184, Osaka=g298566, Kyoto=g298564, Bangkok=g293916, Phuket=g293920, Singapore=g294265, Bali=g294226, Kuala Lumpur=g298570, Hong Kong=g294217, Taipei=g293913, Da Nang=g298085, Ho Chi Minh=g293925, Hanoi=g293924, Cebu=g294261, Manila=g298573, Paris=g187147, London=g186338, New York=g60763

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

The hotel list request transmits user-selected location context to an external service to retrieve available hotels. Although operationally necessary for the feature, it still exposes user travel interests to a third party and should not occur silently.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

Get Hotel List

bash
curl -s "https://data.xotelo.com/api/list?location_key=${LOCATION_KEY}&limit=${LIMIT}"

Returns per hotel: name, key, review_summary.rating (out of 5), review_summary.count, price_ranges.minimum/maximum, geo, image, url.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The rate lookup sends hotel selection and travel dates to Xotelo, revealing concrete itinerary information to an external service. Dates and destination together can be sensitive, so undisclosed transmission creates a real privacy vulnerability in this skill context.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

Get OTA Prices

bash
curl -s "https://data.xotelo.com/api/rates?hotel_key=${HOTEL_KEY}&chk_in=${CHECK_IN}&chk_out=${CHECK_OUT}&currency=${CURRENCY}"

Returns per OTA: code, name, rate (before tax), tax. Add 1s delay between requests.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

Price Heatmap (optional, for flexible dates)

bash
curl -s "https://data.xotelo.com/api/heatmap?hotel_key=${HOTEL_KEY}&currency=${CURRENCY}"

Step 4: Apify Mode (Optional)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

Price Heatmap (optional, for flexible dates)

bash
curl -s "https://data.xotelo.com/api/heatmap?hotel_key=${HOTEL_KEY}&currency=${CURRENCY}"

Step 4: Apify Mode (Optional)

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The Apify mode transmits destination, check-in/check-out dates, rooms, adults, and currency to a third-party scraping service, and uses an API token in the request URL. This increases both privacy exposure and credential-handling risk, since URL tokens are more likely to leak via logs, telemetry, or intermediary systems.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

If APIFY_API_KEY is set, use for Agoda-specific deep search:

bash
curl -s -X POST "https://api.apify.com/v2/acts/knagymate~fast-agoda-scraper/runs?token=${APIFY_API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"city":"'"${DESTINATION}"'","checkIn":"'"${CHECK_IN}"'","checkOut":"'"${CHECK_OUT}"'","rooms":'"${ROOMS}"',"adults":'"${ADULTS}"',"currency":"'"${CURRENCY}"'","maxItems":15}'

Static analysis

No suspicious patterns detected.