RollingGo Hotel Search

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:13 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent hotel-search helper, but it ships a shared API key and directs agents to run always-latest third-party packages, which users should review before installing.

Install only if you are comfortable with a third-party hotel CLI receiving your travel-search details and with the current documentation's shared API key model. Prefer using your own API key, avoid passing secrets on command lines or storing them in Markdown config, and pin RollingGo to a reviewed version in an isolated environment instead of following the always-latest or global upgrade instructions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:70

Finding

Automatic Execution of Unpinned Third-Party Package Releases

Content

View full analysis

... uv tool upgrade rollinggo ``` ### Technical Analysis The Skill deliberately retrieves the newest available `rollinggo` release whenever it runs or upgrades an installed copy before use. The `@latest` npm selector and the `uvx --refresh` behavior resolve to mutable external artifacts whose contents can change after this Skill has been reviewed. The project does not provide an exact reviewed version, integrity hash, lockfile, signed artifact verification procedure, or publisher identity validation. The `npx --yes` option also suppresses the normal installation confirmation. Consequently, the code eventually executed is not limited to the code represented by this audited project. Package installation and invocation can execute package CLI code and, depending on package-manager behavior, installation lifecycle code. The documented global installation path expands the affected scope by modifying the user's global tool environment. The external package implementation is ...[truncated 1824 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:48

Finding

Hard-Coded Shared API Credential Exposed in Project Documentation and Commands

Content

View full analysis

Remediation

View remediation

` rather than a working credential. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (27)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Publishing a usable API key in the skill without any warning about credential sensitivity or usage boundaries is a serious security and operational weakness. It can enable unauthorized reuse, quota exhaustion, service abuse, and downstream compromise if users assume embedding secrets in skill docs is acceptable practice.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Publishing a real API key in markdown and instructing direct use is a severe secret-handling failure. In context, a travel/hotel skill does not need to expose shared credentials to end users, so the mismatch makes this more dangerous by enabling unauthorized API use, abuse, billing exposure, and downstream privacy issues.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file embeds and promotes use of a hard-coded API key in plaintext, including copy-paste export commands and direct CLI usage. Exposing a credential in reference documentation enables unauthorized use, quota theft, billing abuse, and makes secret rotation difficult; in a skill context it also normalizes unsafe credential handling for downstream users and agents.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The markdown not only exposes an API key but presents it without any warning about secrecy, least privilege, or privacy implications. That increases the likelihood of uncontrolled reuse and leakage, and in an agent skill ecosystem it can propagate bad practices into automated workflows and logs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill sends user travel data such as destination, dates, occupancy, and search queries to an external hotel service but does not clearly disclose that this information leaves the local system. While this is consistent with the tool's purpose, the omission weakens informed consent and may create privacy/compliance issues for sensitive itineraries or corporate travel data.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation embeds and directs use of a hardcoded API key, effectively distributing a credential inside the skill. Even if intended as a public/shared key, this encourages unsafe credential handling, makes abuse attribution impossible, and may grant unauthorized access or quota consumption against the external service.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation claims credentials are resolved from flag or environment variable, but surrounding instructions normalize use of a fixed embedded key. This inconsistency can mislead operators into trusting that normal secret-management practices are being used when the workflow actually substitutes a shared hardcoded credential.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The skill explicitly instructs use of rollinggo@latest via npx, which pulls and executes whatever the newest package version is at runtime. This creates a supply-chain risk: a compromised publisher account, malicious release, or breaking update could cause arbitrary code execution in the user's environment without review.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

uvx --refresh --from rollinggo rollinggo ... likewise fetches the latest available package at execution time, increasing exposure to malicious or unreviewed upstream changes. Because this is an execution path for a CLI tool, a bad release could immediately run attacker-controlled code locally and access environment variables such as API keys.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The primary workflow tells the operator to export a specific API key, overriding the manifest's expectation that the environment should supply the required secret. This directly operationalizes insecure secret distribution and increases the chance that the shared credential is copied into shells, logs, transcripts, or automation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file embeds a real-looking API key directly in documentation and instructs users to export it as an environment variable or pass it on the command line, but does not warn that CLI flags may be exposed in shell history, process listings, logs, screenshots, or shared config files. Even if described as a 'public' key, normalizing hardcoded credential distribution increases the chance of misuse, quota theft, service abuse, and accidental reuse in more sensitive contexts.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The documentation tells users to execute a package from npm using npx ... rollinggo@latest, which pulls and runs the newest published code at execution time rather than a reviewed, fixed version. If the package is compromised, hijacked, or updated with unsafe behavior, users of the skill could execute attacker-controlled code on their machine or in an agent runtime.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The documentation instructs users to run npx --yes --package rollinggo@latest ..., which fetches and executes the newest remote npm release at runtime. Using @latest creates a supply-chain risk because any compromised or malicious future publish would be executed immediately without review or pinning.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file instructs runtime installation and execution of a remote npm package, which introduces code-fetch and execution capability not bounded by the static skill content. In this hotel-search skill, that is especially risky because the skill's apparent narrow purpose can mask broad code execution inherited from the npm package and any of its dependencies.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This command again directs runtime execution of rollinggo@latest via npx, pulling fresh code from npm on each invocation. In a skill context, that means behavior can change outside the reviewed repository, increasing supply-chain and remote code execution exposure.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

This finding appears to refer to the 'Version Freshness' guidance that recommends always using the latest npm release. Even though the matched text is imprecise, the surrounding content promotes unpinned remote package execution, which is a real supply-chain risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The reference states that the latest-by-default prefix is npx --yes --package rollinggo@latest rollinggo, again normalizing unpinned code execution. This is dangerous because a later npm publish could alter behavior or execute malicious code under the user's privileges.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The documentation embeds a hardcoded API key and tells users to export or pass it on the command line. This exposes credentials in plaintext, encourages leakage into shell history/process lists/logs, and suggests insecure credential distribution practices.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The troubleshooting section recommends npx --yes --package rollinggo@latest rollinggo ..., which again encourages fetching and executing the newest remote package in order to resolve issues. Troubleshooting paths are frequently copied verbatim, so this repetition materially increases exposure to supply-chain compromise.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The documentation instructs users to execute the rollinggo package via uvx --from rollinggo without pinning a specific version. That creates a supply-chain risk: future compromised or malicious releases would be fetched and executed automatically, and this file explicitly recommends latest-by-default behavior, which increases exposure.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

This command again uses uvx --from rollinggo without a pinned version, so running it may fetch and execute whatever release is current at invocation time. In an agent skill context, that means behavior can change silently and a compromised upstream package could lead to arbitrary code execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

uvx --refresh --from rollinggo is especially risky because it forces retrieval of the latest release on every execution. That maximizes supply-chain exposure by ensuring no previously vetted version is reused, so any malicious or broken upstream update is immediately executed.

Content

No source excerpt is available for this finding.