ClawHub
Back to skill

Security audit

AigoHotel MCP

Security checks for vulnerabilities and agentic risk

Overview

This hotel-booking skill has a coherent purpose, but it installs and runs mutable external software while handling real bookings and personal data, so it needs review before installation.

Install only if you trust the RollingGo npm package and GitHub release channel. Avoid running the installer with administrator privileges, review any update before applying it, and be aware that the skill can submit real hotel orders and expose booking history, names, email addresses, and payment links through its CLI workflow.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
scripts/install.py:129
Finding

Mutable Remote Executable Downloaded and Executed Without Integrity Verification

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
scripts/install.py:20
Finding

Unpinned Package Installed Globally Through npm

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/rgh.js:22
Finding

Windows Shell Invocation Permits Command Injection Through Forwarded Arguments

Content
View full analysis
{ if (typeof arg === 'string' && arg.includes(' ') && !arg.startsWith('"')) { return `"${arg}"`; } return arg; }); } const { cmd, shell, fallbackCmd } = resolveExecutable(); function runChild(targetCmd, useShell) { const args = useShell ? sanitizeArgs(process.argv.slice(2)) : process.argv.slice(2); const child = spawn(targetCmd, args, { stdio: 'inherit', env: process.env, shell: useShell, }); ``` A corresponding shell-enabled execution path exists in `scripts/rgh.py:45-49`: ```python def main(): args = [target_cmd] + sys.argv[1:] try: use_shell = is_win and target_cmd.endswith(".cmd") res = subprocess.run(args, shell=use_shell) ``` ### Technical Analysis On Windows, both wrappers use a command shell when the resolved executable is a `.cmd` launcher. Arguments are derived directly from `process.argv` or `sys.argv`, and the Skill workflow uses user-derived values such as locations, original search queries, hotel names, email addresses, and guest data as CLI parameters. The JavaScript `sanitizeArgs` function only adds quotes when an argument contains a space. It does not safely escape Windows command-shell metacharacters such as `&`, `|`, `<`, `>`, `^`, `%`, `!`, parentheses, or embedded quotation marks. Arg ...[truncated 1910 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (19)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The manifest presents the skill as a hotel search/booking assistant, but the instructions also require installing software, downloading binaries, modifying the local filesystem, and changing execution flow based on tool versioning. This mismatch increases the chance that users or orchestrators grant trust appropriate for a booking skill while the skill performs privileged system-management actions.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md
> - **每日检查**：若当前目录下的 `.version_check` 不存在或记录日期非今天，静默请求远端 `SKILL.md`（地址拼接规则：将元数据中的 `{repository}` 域名替换为 `raw.githubusercontent.com`，并在末尾追加 `/main/skills/{name}/S

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill declares no explicit tool scope while instructing use of shell commands, network access, environment handling, file writes, and local installation flows. This weakens least-privilege boundaries and can let an agent invoke broader capabilities than users would reasonably expect from a hotel-booking skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The description-level trigger list includes generic phrases like lodging-related terms that may appear in normal conversation without clear intent to use this skill. Because the skill can progress into network operations and commerce-related steps, ambiguous activation raises the risk of unintended actions and unnecessary exposure of account-linked flows.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The file is written entirely in Chinese and prescribes fixed Chinese response phrases and templates, but it does not state that the skill is China-only or that users may choose another language. This can violate language/locale policy when used in broader environments because it imposes a language without opt-in.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The update instruction uses an unpinned 'npx skills' invocation, which can fetch and execute whatever package version is current at runtime. That creates a software supply-chain risk: a compromised upstream package or unexpected breaking release could run arbitrary code in the agent environment.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger scope is broad enough to activate on ordinary travel or lodging conversation, increasing the chance the skill runs when the user did not intend to invoke a hotel-booking workflow. In this skill, accidental activation is more dangerous because invocation can lead to login prompts, network calls, software installation, and eventually real purchase flows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown section documents book as accepting email and guest identity details, which are user-sensitive data used to create a formal order. The description does not include any warning that this information will be transmitted to an external booking service or used to place a real reservation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This section states that the command returns all historical hotel orders and includes personally identifiable information such as contact names and email addresses. The documentation lacks any warning that invoking this command reveals sensitive booking history and personal data.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/install.py (reported line 13)May include surrounding context.

python
def run_command(args):
    """Run a system command and return exit code and output."""
    try:
        result = subprocess.run(args, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
        return result.returncode, result.stdout, result.stderr
    except Exception as e:
        return -1, "", str(e)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/install.py (reported line 30)May include surrounding context.

python
print("✅ Successfully installed @rollinggo/hotel globally via npm!")
        return True
    
    print("⚠️ npm global installation failed (might need administrator/sudo permissions).")
    print(stderr)
    return False

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The installer retrieves release metadata from GitHub and then downloads an executable for local use, but it performs no cryptographic signature or checksum verification on the fetched artifact. If the release channel, repository, network trust boundary, or upstream account is compromised, the script could install and later execute a malicious binary, which is especially dangerous in an installer context.

Content

Scanner excerpt · scripts/install.py (reported line 65)May include surrounding context.

python
def get_latest_release_assets():
    """Query GitHub API for the latest release assets."""
    api_url = "https://api.github.com/repos/RollingGo-AI/oauth-hotel-cli/releases/latest"
    req = urllib.request.Request(
        api_url,
        headers={'User-Agent': 'RollingGo-Installer/1.0'}

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/install.py (reported line 87)May include surrounding context.

python
# Check if node and npm are available
    has_node = False
    try:
        node_code = subprocess.call(["node", "--version"], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
        npm_code = subprocess.call(["npm" if platform.system() != "Windows" else "npm.cmd", "--version"], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
        has_node = (node_code == 0 and npm_code == 0)
    except Exception:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/install.py (reported line 88)May include surrounding context.

python
has_node = False
    try:
        node_code = subprocess.call(["node", "--version"], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
        npm_code = subprocess.call(["npm" if platform.system() != "Windows" else "npm.cmd", "--version"], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
        has_node = (node_code == 0 and npm_code == 0)
    except Exception:
        has_node = False

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The manifest describes a hotel search and booking assistant that calls RollingGo hotel service APIs, but this file implements generic subprocess execution by spawning an external rgh program and forwarding all user-provided CLI arguments to it. Launching local executables is a stronger capability than direct API access and is not explicitly justified by the manifest text.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The wrapper forwards arbitrary command-line arguments directly to an external command and, on Windows fallback, may invoke it through a shell. Although the skill appears intended to call its own hotel CLI, there is no validation, allowlist, or user disclosure about what arguments are accepted, which increases the risk of abuse, unexpected side effects, or shell-mediated argument misinterpretation in hostile execution environments.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/rgh.py (reported line 48)May include surrounding context.

python
args = [target_cmd] + sys.argv[1:]
    try:
        use_shell = is_win and target_cmd.endswith(".cmd")
        res = subprocess.run(args, shell=use_shell)
        sys.exit(res.returncode)
    except KeyboardInterrupt:
        sys.exit(130)

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill instructs the agent to perform a daily remote fetch of SKILL.md and write a local marker file regardless of immediate booking needs. This introduces unnecessary network and filesystem side effects, expands attack surface, and creates a covert persistence/update-check mechanism unrelated to the core user task.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The file contains natural-language content in Chinese, including comments and user-facing error messages, without indicating that the skill is Chinese-only or giving users a language/locale option. Per the policy, forcing a specific language without opt-in can be a locale-policy violation.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/rgh.js:46