hotl

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:07 AM UTC
• Version: 0.1.1

Overview

This is a straightforward hotel-search skill, with the main caveat that it installs the current PyPI release of the hotl CLI rather than a pinned reviewed version.

Install hotl in an isolated user environment such as pipx, avoid administrator installs, and consider pinning or reviewing the package version if you need reproducible or higher-assurance use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10

Finding

Unpinned and Unaudited Third-Party CLI Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10–15 and 29–35
Vulnerability Type: Supply-chain exposure through an unpinned PyPI dependency
Risk Level: Medium

Vulnerable Code

yaml

"requires": { "bins": ["hotl"] },
"install":
  [
    {
      "id": "python",
      "kind": "python",
      "package": "hotl",
      "bins": ["hotl"],
      "label": "Install hotl from PyPI",
    },
  ],

bash

pipx install hotl

bash

python -m pip install hotl

Technical Analysis

The Skill instructs the agent to install the latest package named hotl from PyPI without specifying a reviewed version or verifying an integrity hash. The project does not include the dependency's implementation, a lock file, package hashes, or a reference to a verified source repository. Consequently, the effective code executed by this Skill can change after the Skill itself has been reviewed.

Python package installation may execute third-party build or packaging logic, while subsequent hotl commands execute the installed package directly. A compromised maintainer account, malicious package release, or other supply-chain compromise could therefore introduce arbitrary behavior without any modification to SKILL.md.

The CLI's declared function legitimately requires network access for hotel searches. Supplying destinations, travel dates, filters, and Google Hotels entity_key values is consistent with that function and is not independently evidence of malicious exfiltration. However, because the CLI implementation is absent, the audit cannot verify its network destinations, retention practices, telemetry, or whether it transmits additional local information. The dependency is therefore granted more trust than can be justified from the reviewed project alone.

Attack Path

1. An attacker compromises the hotl PyPI project, its publisher credentials, or a future package release.
2. The S ...[truncated 1524 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin hotl to an explicitly reviewed version in both the Skill metadata and installation examples.
2. Require cryptographic hashes for downloaded distributions, such as through a locked requirements file and pip --require-hashes.
3. Record the expected package publisher, canonical source repository, release artifact, and checksum so operators can verify provenance.
4. Audit or vendor the exact dependency implementation, including installation hooks, network endpoints, telemetry, and handling of query data and entity_key values.
5. Install the CLI in an isolated, non-privileged environment using pipx or a dedicated virtual environment; never recommend root or administrator installation.
6. Restrict outbound network access to documented hotel-search endpoints where the execution environment supports egress controls.
7. Avoid exposing unrelated secrets to the CLI process. Provide only the destination, dates, filters, and tokens required for the requested search.
8. Establish an update-review process so version changes require renewed source and artifact verification rather than automatically accepting the newest PyPI release.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep