ClawHub
Back to skill

Security audit

rollinggo-hotel

Security checks across malware telemetry and agentic risk

Overview

This hotel booking skill is mostly coherent, but it asks agents to install and auto-update unpinned external executables and can create real booking orders with personal data, so users should review it carefully before installing.

Install only if you trust RollingGo's CLI and are comfortable with a skill that can log in, handle travel contact details, retrieve order history, create hotel orders, and show payment links. Prefer a pinned and verified CLI release, require explicit confirmation before any booking action, and do not allow unattended auto-updates during a booking workflow.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill declares no permissions while clearly instructing installation and execution of external tools, network access, and shell-like operations. This undermines trust and reviewability because users and hosting systems cannot accurately assess the skill's execution capabilities before use.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The manifest presents the skill as a hotel-booking assistant, but the instructions also perform software installation, binary download, version checks against remote content, and execution of an external CLI. That mismatch can mislead users and security controls, increasing the chance that risky behavior is approved under an innocuous description.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger guidance is broad enough to activate on many common travel-related phrases, which can cause the agent to invoke booking-related tooling unexpectedly. In a skill that can install software, authenticate users, and progress toward purchases, overbroad activation increases the risk of unintended sensitive actions.

Vague Triggers

Medium
Confidence
82% confidence
Finding
Embedding a long, broad trigger list in the manifest description encourages accidental invocation from generic accommodation-related language. Because this skill can reach external services and assist with real transactions, false activations materially increase operational and privacy risk.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The documented `book`, `orders`, and `order-detail` flows handle and expose personal and booking data such as names, email, hotel stay details, order numbers, and payment status without any explicit privacy warning, data-minimization guidance, or consent language. In an agent skill context, this increases the risk that users or downstream agent logic will disclose, retrieve, or surface sensitive travel data without understanding the sensitivity of the action.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The `book` command is explicitly effectful: it creates an official external order and returns a payment link, yet the documentation does not instruct agents to obtain explicit user confirmation before invoking it. In an autonomous or semi-autonomous agent setting, this omission can lead to accidental bookings, unintended charges, or user confusion about whether a reservation has actually been placed.

Natural-Language Policy Violations

Medium
Confidence
91% confidence
Finding
The wrapper unconditionally assigns a default CLIENT_ID of 'rollinggoglobal' whenever the environment variable is absent, causing requests to be attributed to an overseas client context without explicit user selection or consent. In a hotel booking skill that may process travel queries and booking-related data, silently routing usage under a global client identifier can create privacy, compliance, tenancy, or policy-boundary issues if users expected a different regional or account context.

Missing User Warnings

Medium
Confidence
76% confidence
Finding
The wrapper forwards all command-line arguments directly to an external executable without any validation, allowlist, or confirmation. In an agent context, this broad pass-through can expose unintended capabilities of the underlying CLI, allowing prompts or tool calls to trigger operations beyond the hotel assistant's stated scope if the external binary supports additional flags or behaviors.

External Transmission

Medium
Category
Data Exfiltration
Content
def get_latest_release_assets():
    """Query GitHub API for the latest release assets."""
    api_url = "https://api.github.com/repos/RollingGo-AI/oauth-hotel-cli-overseas/releases/latest"
    req = urllib.request.Request(
        api_url,
        headers={'User-Agent': 'RollingGo-Installer/1.0'}
Confidence
90% confidence
Finding
https://api.github.com/

Direct Prompt Extraction

High
Category
System Prompt Leakage
Content
After downloading, rename it to `rgg` (or `rgg.exe` on Windows), grant execution permissions, and place it in the system PATH or the skill directory's `bin` folder.

**⚠️ Auto-Update Interception Principle:**
The CLI tool has built-in version detection. When you execute any `rgg` command, if the console output prompts `📦 New version available!` or `Run the following command to update`, **you must immediately pause the current operation, use one of the above three methods to upgrade the tool to the latest version, and then re-execute the interrupted command.** This prevents booking failures due to expired server endpoints.

---
Confidence
91% confidence
Finding
output prompt

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/rgg.js:46