pricewin-booking-assistant

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:41 AM UTC
• Version: 1.0.3

Overview

The skill is a disclosed hotel-booking assistant, but it should be reviewed because it creates real reservations and sends guest PII plus the user's original request text to PriceWin's backend.

Install only if you are comfortable letting the PriceWin MCP backend create real hotel reservations and receive guest contact details. Before booking, confirm the hotel, room, dates, guests, total price, email, phone, payment method, and cancellation terms; avoid including unrelated sensitive information in the original request because the skill tells the agent to send that text verbatim.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:98

Finding

Unnecessary Transmission of Verbatim User Input to a Remote Backend

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:98-100
Vulnerability Type: Excessive disclosure of potentially sensitive user data
Risk Level: Medium

Vulnerable Code Snippet

text

Required: `propertyId`, `roomTypeId`, `checkIn`, `checkOut`, `adults`, `guestName`,
`guestPhone`, `guestEmail`, `paymentMethod`, `totalAmount`, `currency`.
Also pass `queryText` (user's original text, verbatim).

The behavior is corroborated by SECURITY.md:37-46:

text

| Tool | Personal data sent |
|---|---|
| `create_booking` | **guest full name, phone number, email address**, plus `propertyId`, `roomTypeId`, dates, adults, `totalAmount`, `currency`, `paymentMethod`, and `queryText` |
| `check_booking_status` | `confirmationCode` |
| `recreate_payment_link` | `confirmationCode` |
| `request_cancel_token` | `confirmationCode`, **guest email** |
| `cancel_booking` | `confirmationCode`, `cancelToken`, cancellation reason |

⚠️ `queryText` is **the user's original request, verbatim** — it goes to the
server as typed.

The tool contract in reference.md:35-39 establishes that this field is optional:

text

**`create_booking`** — required: `propertyId`, `roomTypeId`, `checkIn`, `checkOut`,
`adults`, `guestName`, `guestPhone`, `guestEmail`, `paymentMethod`, `totalAmount`,
`currency` (ISO 4217, 3 chars). Optional: `children` (default 0), `language`, `queryText`.

Technical Analysis

The Skill instructs the agent to transmit the user's original request verbatim as queryText when creating a booking. The underlying tool contract explicitly marks this field as optional. The structured booking parameters already convey the property, room, dates, guest count, contact details, price, currency, and payment method needed to perform the reservation.

A user's original message can contain unrelated or excessive information, including personal preferences, precise location details, medical accessi ...[truncated 1726 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the requirement to pass the user's original request verbatim.
2. Omit the optional queryText field from create_booking by default.
3. If the backend requires search context, generate a minimized summary containing only necessary non-sensitive criteria, such as destination, dates, and occupancy.
4. Strip contact details, free-form notes, payment information, third-party information, and unrelated conversational content before transmission.
5. If verbatim transmission is operationally necessary, obtain explicit informed consent immediately before sending it and explain the recipient and purpose.
6. Document backend retention periods, deletion procedures, access controls, encryption protections, and restrictions on secondary use.
7. Add an instruction requiring the agent to review free-form fields for secrets, payment credentials, and unrelated sensitive data before any network transmission.
8. Update SECURITY.md and reference.md so their privacy guidance consistently reflects the minimized behavior.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SECURITY.md (reported line 53)May include surrounding context.

md

**No card numbers, CVV, bank credentials, or PayPal logins.** `paymentMethod` is
only a choice of rail (`SEPAY` / `POLAR` / `PAYPAL`); `create_booking` returns a
payment **link**, and the user enters their payment details on the payment
provider's own page. Neither this skill nor the agent ever sees them — do not ask
the user for card details, and refuse if they offer them in chat.

### Rules the skill imposes on the agent

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This skill enables creation of real hotel bookings and collection of personal data plus payment-link issuance, but the reference omits an explicit requirement to warn the user that the action creates a real-world reservation and may trigger financial obligations. In an agent setting, that increases the risk of users authorizing a transaction without fully understanding that the action is not a simulation, especially because the workflow is designed to complete booking end to end.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The cancellation flow describes the technical token process but does not require the agent to warn that cancellation may be irreversible, may forfeit prepaid amounts, or may incur penalties under the property's cancellation policy. In a booking assistant, omission of that warning can lead users to authorize destructive account actions without understanding financial consequences.

Content

No source excerpt is available for this finding.