ClawHub
Back to skill

Security audit

rollinggo-hotel-cn

Security checks for vulnerabilities and agentic risk

Overview

This hotel-booking skill mostly does what it says, but it needs Review because its installer and upgrade flow can pull and run latest CLI code without integrity checks.

Install only if you trust RollingGo and are comfortable with the skill installing or upgrading a local booking CLI from npm/GitHub. Review the CLI source or pin/verify the binary where possible, and only provide guest names, email, and payment-link actions when you intend to make a real booking.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill declares no permissions, yet its instructions require shell execution, network access, environment-variable injection, package installation, and downloading executables. This undermines least-privilege expectations and can cause a host agent or reviewer to approve a skill without understanding its real execution capabilities.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The manifest presents the skill as a hotel booking assistant, but the documented behavior includes global npm installs, Python install scripts, release downloads, local binary drops, subprocess launching, and arbitrary argument forwarding. That mismatch hides materially broader execution power than users would reasonably expect from a booking skill, increasing supply-chain and command-execution risk.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The installation section directs the agent to run global package-manager commands, execute a local Python installer, or manually download binaries from releases. These steps introduce substantial supply-chain and arbitrary-code-execution risk that is much broader than hotel search/booking, especially when paired with 'latest' installs and release-based binary fetching.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger rule says the skill should fire for essentially any lodging-related intent, making activation overly broad. In an agent environment with tool autonomy, this increases the chance of unnecessary external calls, login prompts, or setup/install behavior being triggered during ambiguous conversation.

Vague Triggers

Medium
Confidence
81% confidence
Finding
Several trigger phrases are common everyday terms without sufficient contextual constraints, which can cause the skill to activate in benign conversation. Because this skill can lead to authorization, network access, and installation/execution workflows, false activation is more dangerous than for a purely informational skill.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The booking command requires and accepts personal data including contact email and guest names, but the documentation provides no privacy handling guidance, minimization advice, or warning that this is sensitive information. In an agent skill context, this increases the chance that downstream components log, echo, retain, or mishandle PII during booking flows.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The order query commands return historical booking data plus contact details such as names and email without any warning that the output is sensitive. In an agent environment, bulk retrieval of past orders can expose more personal data than needed and can be accidentally surfaced to users, logs, or other tools if access control and output handling are not clearly constrained.

External Transmission

Medium
Category
Data Exfiltration
Content
def get_latest_release_assets():
    """Query GitHub API for the latest release assets."""
    api_url = "https://api.github.com/repos/RollingGo-AI/oauth-hotel-cli/releases/latest"
    req = urllib.request.Request(
        api_url,
        headers={'User-Agent': 'RollingGo-Installer/1.0'}
Confidence
87% confidence
Finding
The installer fetches release metadata from GitHub and later downloads and installs an executable based on that network response, but it does not verify checksums, signatures, or a pinned release version. If the upstream repository, release assets, or network trust chain were compromised, users could receive and execute a malicious binary through this skill installer.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/rgh.js:46