ClawHub
Back to skill

Security audit

rollinggo-hotel-cn

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent hotel booking assistant, but it asks agents to install and update mutable executable tooling and has Windows wrapper patterns that can turn user-provided booking text into shell execution risk.

Review this skill before installing. It can interact with a real hotel booking service, collect contact details, create orders and payment links, and read booking history. Only install it if you trust RollingGo's npm and GitHub release channels, and prefer a pinned, verified, skill-local executable before using it for bookings.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
scripts/install.py:129
Finding

Mutable Remote Executables Are Downloaded Without Integrity Verification

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/rgh.js:17
Finding

Windows Node.js Wrapper Forwards User-Controlled Arguments Through a Command Shell

Content
View full analysis
{ if (typeof arg === 'string' && arg.includes(' ') && !arg.startsWith('"')) { return `"${arg}"`; } return arg; }); } const { cmd, shell, fallbackCmd } = resolveExecutable(); function runChild(targetCmd, useShell) { const args = useShell ? sanitizeArgs(process.argv.slice(2)) : process.argv.slice(2); const child = spawn(targetCmd, args, { stdio: 'inherit', env: process.env, shell: useShell, }); ``` ```javascript if (err.code === 'ENOENT' && fallbackCmd && targetCmd !== fallbackCmd) { runChild(fallbackCmd, true); } ``` ### Technical Analysis On Windows, the wrapper deliberately invokes `rgh.cmd` with `shell: true`. If that launcher is unavailable, the fallback also invokes `rgh` through a shell. The custom `sanitizeArgs` function only surrounds arguments containing spaces with quotation marks. It does not safely encode or reject Windows command-shell metacharacters such as `&`, `|`, `<`, `>`, `^`, `%`, and parentheses. Arguments without spaces are not transformed at all. The Skill workflow forwards user-influenced values such as original search queries, locations, hotel names, guest names, and email addresses to this wrapper. Consequently, shell syntax embedded in those values may be interpreted by `cmd.exe` rat ...[truncated 1270 chars]
Remediation
View remediation
`, `^`, `%`, parentheses, quotation marks, and newline characters. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
scripts/rgh.py:18
Finding

Windows Python Wrapper Executes a Command Script Through the Shell

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (18)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill is presented as a hotel booking assistant, but its behavior includes package installation, downloading binaries from GitHub releases, writing .version_check, modifying local files/permissions, and environment/platform detection. This mismatch matters because users or hosts may authorize the skill expecting only hotel-search functionality, while it actually performs broader system-changing operations that expand attack surface and can be abused via compromised dependencies or remote content.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md
> - **每日检查**：若当前目录下的 `.version_check` 不存在或记录日期非今天，静默请求远端 `SKILL.md`（地址拼接规则：将元数据中的 `{repository}` 域名替换为 `raw.githubusercontent.com`，并在末尾追加 `/main/skills/{name}/S

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The skill explicitly requires and instructs use of shell, network, and environment-dependent tooling (node, python, curl, wget, npm installs, login flows, remote version checks) but does not declare any permissions or allowed-tools scope. This creates an under-specified trust boundary where a host may grant broader capabilities than users expect, increasing risk of unintended command execution, network access, and local file modification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The manifest description and the entire operational guidance are written to require Chinese phrasing and Chinese output conventions, but the file does not offer users a language or locale choice. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the regional restriction is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The update instruction uses npx skills update {name} without pinning a specific trusted version of the updater. Because npx may resolve and execute whatever package version is current at execution time, this introduces a supply-chain risk where a compromised or incompatible upstream release could run arbitrary code on the user's machine.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger list is very broad and includes generic terms like '入住', '住哪', '住宿', and other common lodging/travel phrases, which can cause the skill to activate in contexts where the user did not intend to initiate a booking workflow. In a skill with shell, network, login, installation, and payment-related behavior, accidental activation is more dangerous because it can prompt external auth flows, perform remote queries, or steer the user into transactional actions unnecessarily.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The book command explicitly collects and transmits personal data including contact name, email, and guest identity fields, but the documentation does not warn operators that they are handling and sending PII to an external booking service. In a hotel-booking skill, this omission increases the chance of unnecessary collection, accidental disclosure, or use without informed user consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The orders and order-detail commands expose historical booking records and contact details such as names, email, dates, addresses, and payment/order status, yet the document provides no privacy or access-control warning. In this skill context, these commands can reveal sensitive travel history and personal information if invoked without strong authorization checks or if outputs are logged broadly.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/install.py (reported line 13)May include surrounding context.

python
def run_command(args):
    """Run a system command and return exit code and output."""
    try:
        result = subprocess.run(args, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
        return result.returncode, result.stdout, result.stderr
    except Exception as e:
        return -1, "", str(e)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/install.py (reported line 30)May include surrounding context.

python
print("✅ Successfully installed @rollinggo/hotel globally via npm!")
        return True
    
    print("⚠️ npm global installation failed (might need administrator/sudo permissions).")
    print(stderr)
    return False

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The script fetches release metadata and later downloads executable artifacts from remote GitHub endpoints, then installs them without any integrity verification such as pinned checksums or signature validation. In an installer context this is more dangerous because a compromised GitHub account, tampered release asset, MITM via a broken trust store, or poisoned dependency source could lead to arbitrary code execution when the downloaded binary is run.

Content

Scanner excerpt · scripts/install.py (reported line 65)May include surrounding context.

python
def get_latest_release_assets():
    """Query GitHub API for the latest release assets."""
    api_url = "https://api.github.com/repos/RollingGo-AI/oauth-hotel-cli/releases/latest"
    req = urllib.request.Request(
        api_url,
        headers={'User-Agent': 'RollingGo-Installer/1.0'}

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/install.py (reported line 87)May include surrounding context.

python
# Check if node and npm are available
    has_node = False
    try:
        node_code = subprocess.call(["node", "--version"], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
        npm_code = subprocess.call(["npm" if platform.system() != "Windows" else "npm.cmd", "--version"], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
        has_node = (node_code == 0 and npm_code == 0)
    except Exception:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/install.py (reported line 88)May include surrounding context.

python
has_node = False
    try:
        node_code = subprocess.call(["node", "--version"], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
        npm_code = subprocess.call(["npm" if platform.system() != "Windows" else "npm.cmd", "--version"], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
        has_node = (node_code == 0 and npm_code == 0)
    except Exception:
        has_node = False

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

This code launches an external command via spawn and passes through process arguments and the full environment, which can affect the system or transmit data depending on the invoked tool. Although there is error logging, there is no confirmation prompt, user-facing notice before execution, or explanatory comment warning about the subprocess behavior itself.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/rgh.py (reported line 48)May include surrounding context.

python
args = [target_cmd] + sys.argv[1:]
    try:
        use_shell = is_win and target_cmd.endswith(".cmd")
        res = subprocess.run(args, shell=use_shell)
        sys.exit(res.returncode)
    except KeyboardInterrupt:
        sys.exit(130)

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

All user-facing headings, parameter descriptions, and operational text are presented only in Chinese, with no indication that another language is available or that Chinese is a justified region-specific requirement. Under SQP-3, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file contains Chinese-only comments and user-facing error messages, such as the console output on execution failure, with no indication that language is configurable or intentionally region-scoped. This can violate a language/locale policy when a skill imposes a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

The console.error messages shown to users are written only in Chinese, and the file does not offer any language selection or fallback. Under the stated policy, forcing a specific language in natural-language output is a locale-policy concern unless clearly documented and justified.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/rgh.js:46