Daolv Hotel Booking Assistant

• Analyzed: May 11, 2026, 4:43 AM
• Findings: 1
• Version: 0.1.0
• Hash: 4843c6829a0e5fa4a4063ac6767e359a1efa4f4e28c490544053a5db7219a762
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to the presence of a hardcoded API key (`mcp_171e1ffa7da343faa4ec43460c52b13f`) in `references/mcp-client-config.json`. While this key is used for the skill's stated purpose of interacting with the `aigohotel-mcp` service, its direct inclusion in the skill bundle makes it publicly exposed. This constitutes a significant vulnerability, as anyone can extract and potentially abuse this key for unauthorized access to the `aigohotel-mcp` API, even if the skill itself does not exhibit malicious intent like data exfiltration or system compromise.