pricewin-price-comparison

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:38 AM UTC
• Version: 1.0.3

Overview

This hotel price comparison skill is mostly coherent, but it tells the agent to send the user's full original message to a hosted third-party service, which can expose unrelated personal details.

Review this before installing if your hotel requests may include phone numbers, medical/accessibility details, employer context, confidential travel plans, or other unrelated personal information. Prefer using only structured hotel, city, date, guest, and room fields, or avoid this skill unless you accept sending full query text to PriceWin's hosted service.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:46

Finding

Unnecessary Disclosure of Verbatim User Messages to a Third-Party MCP Service

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:46, SKILL.md:86, SECURITY.md:31-42, reference.md:34-36
Vulnerability Type: Excessive transmission of unsanitized user-controlled data
Risk Level: Medium

Vulnerable Code Snippets

SKILL.md:46:

markdown

- Required: `checkIn`, `checkOut`. Pass `hotelName` + `city` + `queryText` (verbatim user text) whenever known

SKILL.md:86:

markdown

`queryText` — the user's message verbatim

SECURITY.md:31-42:

markdown

Only the arguments the agent passes to a tool — a **travel query, not personal
data**:

| Tool | Data sent |
|---|---|
| `search_hotels_live` / `poll_search_results` | city, dates, adult count, language, `sessionId` |
| `get_ota_hotel_detail` | hotel name, city, dates, `queryText` |
| `get_hotel_detail` | `propertyId`, dates, adult count |
| `get_cancellation_policy` | `propertyId`, `ratePlanId`, check-in date |

⚠️ `queryText` is **the user's original request, verbatim**. Whatever the user
typed goes to the server as-is, so do not pass a message that carries unrelated
personal context.

reference.md:34-36:

markdown

**Required:** `checkIn`, `checkOut`
**Strongly recommended:** `hotelName`, `city`, `queryText` (user's original text, verbatim)
**Optional:** `adults` (default 2), `rooms` (default 1), `language`, `propertyUrl`

Technical Analysis

The skill strongly recommends transmitting the user's original message verbatim through the queryText field to PriceWin's hosted, closed-source MCP service. This violates data-minimization principles because the operation already provides structured fields for the hotel name, city, dates, guest count, and other search criteria.

Free-form user messages can contain information unrelated to the hotel search, including names, contact details, travel plans, account information, health or accessibility informatio ...[truncated 2109 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the instruction to send the user's original message verbatim.
2. Omit queryText by default when structured parameters are sufficient.
3. If queryText is technically required, construct it from an allowlisted set of fields, such as the hotel name and city, rather than copying arbitrary user input.
4. Strip contact details, credentials, payment information, identifiers, unrelated personal context, and other sensitive content before transmission.
5. Require explicit user consent before sending free-form text to the hosted MCP service.
6. Update SKILL.md, SECURITY.md, and reference.md consistently so they describe the sanitized behavior.
7. Add a clear data-retention and processing disclosure for the hosted service.
8. Prefer a contract in which queryText is optional and document the specific cases in which it is necessary.

A safer instruction would be:

markdown

Pass the structured hotel name, city, dates, and guest fields. Do not send the
user's original message as `queryText`. If a query string is required, construct
a minimal value from the hotel name and city after removing personal or unrelated
information.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The reference lists language as limited to en|vi|de|ja|ko|zh, which is a natural-language locale constraint. Because the document does not explain that this is an opt-in user choice or a justified region-specific limitation, it can be read as forcing a restricted language set.

Content

No source excerpt is available for this finding.