ClawHub
Back to skill

Security audit

rollinggo-hotel

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed hotel-search helper that uses the RollingGo CLI and API key, with ordinary credential and package-install cautions rather than evidence of abuse.

Install only if you trust RollingGo with your hotel search details and API key. Prefer per-skill secret injection, avoid putting real keys directly on command lines, and consider pinning a reviewed RollingGo CLI version instead of always running @latest in sensitive environments.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Low
Confidence
89% confidence
Finding
The reference shows passing the API key directly on the command line (`--api-key YOUR_API_KEY`) and exporting it in shell examples without any warning that command-line arguments may be captured in shell history, process listings, logs, or CI output. In a skill intended for agent/operator use, this increases the chance of inadvertent credential exposure even though the document does not appear malicious.

Unrestricted Tool Access

Medium
Category
Excessive Agency
Content
If using an installed command instead of temporary execution, upgrade first:

- **npm global:** `npm install -g rollinggo@latest`
- **uv tool:** `uv tool upgrade rollinggo@latest`

## Primary Workflow
Confidence
94% confidence
Finding
tool:*

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal