Search Airbnb listings with prices, ratings, and direct links. No API key required.
Security Analysis
medium confidenceThe skill is plausible (it runs a CLI that scrapes Airbnb) but the instructions and install spec are ambiguous about where the actual search implementation comes from and they require pip-installed binaries, which warrants caution before installing.
The skill declares it will search Airbnb and requires the uvx CLI, which is consistent. However, the SKILL.md references a separate PyPI/GitHub project (airbnb-search) while the install spec installs only a pip package named 'uv' (which provides uvx). The skill does not install or include the actual scraper code itself, and it's unclear whether uvx will fetch the referenced airbnb-search plugin automatically. This ambiguity could lead to unexpected runtime behavior.
Runtime instructions only invoke uvx airbnb-search to scrape public Airbnb search results and explicitly state no API key is needed. They do not request reading local files, environment variables, or other unrelated system state. Scraping Airbnb (network calls to Airbnb.com) is expected for the stated purpose.
The skill's install spec uses pip to install the 'uv' package (to provide the uvx binary). Installing pip packages can execute arbitrary code at install time; this is a common but non-trivial risk. Additionally, the install spec does not install the 'airbnb-search' package that SKILL.md links to, creating a mismatch: it's unclear whether uvx will dynamically fetch the scraper or whether the user must separately install the PyPI 'airbnb-search' package.
No environment variables, credentials, or config paths are requested. That is proportionate to the described functionality (public web scraping).
The skill does not request always-on presence and uses default autonomous invocation settings. Nothing in the manifest requests system-wide configuration changes or access to other skills' credentials.
Guidance
Before installing: 1) Verify the pip packages and GitHub repo referenced (check maintainers, recent activity, and package contents). pip installs can run code at install time—only install from trusted publishers. 2) Clarify how 'airbnb-search' is provided at runtime: does uvx dynamically fetch the plugin, or do you need to install the separate PyPI 'airbnb-search' package? 3) Be aware this tool scrapes Airbnb (network access) which can trigger rate limits, blocking, or violate terms of service—use responsibly. 4) If you have low tolerance for supply-chain risk, avoid installing unknown pip packages and instead inspect the 'airbnb-search' code on GitHub/ PyPI before running. 5) If you proceed, run pip installs in an isolated environment (venv/container) and audit the installed package contents and entrypoints.
Latest Release
v1.0.0
Airbnb Search skill initial release. - Search Airbnb listings directly from the command line with pricing, ratings, and direct links—no API key required. - Supports options for date range, guest count, price filters, superhost filtering, output limits, and output format (text or JSON). - Easy setup via OpenClawCLI; can be run one-off or installed globally. - Results include total prices (with cleaning fees), review counts, and superhost status. - Returns either user-friendly or structured JSON output for integration. - See documentation for usage examples and install instructions.
More by @StveenLi
Published by @StveenLi on ClawHub
