Daolv Hotel Booking

• Outcome: Review
• Latest audit: May 28, 2026 at 8:53 AM UTC
• Version:
  0.1.3

Overview

This is a legitimate hotel-search skill, but it ships a reusable bearer token whose owner, scope, and rotation are unclear.

Install only if you are comfortable using the bundled ai-go-hotel MCP credential and sending hotel-search details to that provider. Prefer replacing the embedded token with your own scoped credential before use, and independently confirm prices, cancellation terms, and payment details before booking.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The skill description is broadly scoped to common hotel and travel-planning intents, which can cause over-triggering in unrelated or only partially related conversations. In practice, this raises the chance that the agent invokes external hotel-search tooling and shares user trip details when the user did not clearly request hotel assistance, creating privacy and action-selection risk.

VirusTotal

64/64 vendors flagged this skill as clean.