pricewin-hotel-deal-finder

• Outcome: Pass
• Latest audit: Aug 2, 2026 · 2:58 PM UTC
• Version: 1.1.3

Overview

This skill is a disclosed local hotel-price search tool that uses browser automation and travel APIs, with no artifact evidence of hidden data theft, destructive behavior, or credential use.

Install only if you are comfortable with a local Node tool downloading Chromium, launching a temporary browser daemon, and sending your hotel search details to travel providers. Avoid using its lower-level browse commands for unrelated websites; use the documented search.js path and close the daemon if a run is interrupted.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill clearly instructs the runtime to execute shell commands, use environment variables, and perform network activity, yet it declares no permissions. This creates a transparency and consent problem: an agent or user may invoke the skill without understanding that it will launch local code, access env-controlled endpoints, and make outbound requests.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented behavior goes beyond simple hotel comparison and describes a localhost browser-control daemon with token/state files, arbitrary navigation, debugging, cache operations, and manual selector discovery. That broader capability materially increases attack surface because a skill presented as a narrow travel helper can actually expose privileged browser automation primitives that could be reused for unintended browsing, content inspection, or interaction with arbitrary sites.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The package description says the skill provides generic browser-driving primitives and agentic browser control rather than a narrowly scoped hotel-price comparison tool. That scope mismatch is security-relevant because a broadly browser-controlling package can be repurposed to visit arbitrary sites, interact with untrusted content, or perform actions beyond the user-facing skill description, increasing the risk of deceptive capability hiding and overbroad permissions.

Vague Triggers

Medium

• Confidence: 76% confidence
• Finding: The skill advertises invocation for a very broad class of hotel-related questions, which can cause over-triggering. Unintended activation matters here because the skill performs networked scraping and launches local automation, so a casual or partial hotel query could trigger more powerful actions than the user expected.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The instruction to infer parameters and run without clarifying questions increases the chance the skill will act on guessed dates, guest counts, or destinations. In a skill that executes code and performs live browsing/network requests, ambiguity can lead to unintended searches, privacy issues, or actions based on fabricated assumptions rather than confirmed user intent.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code sends user-supplied travel search details (city, check-in/check-out dates, adults) to a third-party OpenTravel API by default, but this file shows no user-facing notice, consent flow, or privacy control around that transmission. In a hotel-deal-finder skill, such sharing is functionally expected, but it still exposes potentially sensitive travel itinerary data to an external service and can create privacy/compliance risk if users are unaware.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"postinstall": "echo 'Run install.sh next to download Chromium' >&2"
  },
  "dependencies": {
    "patchright": "^1.55.2"
  },
  "engines": {
    "node": ">=20"

• Confidence: 80% confidence
• Finding: The dependency version uses a caret range, allowing newer minor/patch releases of patchright to be installed automatically. In a browser-automation package, dependency drift can introduce unexpected behavior, supply-chain regressions, or newly malicious compromised releases, which is more sensitive because the dependency can control a browser and potentially access web content and session state.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.