rollinggo-searchhotel

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:46 AM UTC
• Version: 1.0.5

Overview

This hotel-booking skill is not clearly malicious, but it needs Review because it installs mutable external executables, silently checks remote content, and can handle real booking and order data.

Install only if you trust RollingGo's npm package, GitHub releases, and CLI service. Do not run the installer as administrator/root, require explicit consent before installs, updates, bookings, payment-link generation, or order-history lookup, and prefer a pinned, checksum-verified CLI over @latest or latest-release downloads.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/install.py:62

Finding

Unverified Mutable Executable Download and Execution

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: scripts/install.py:17

Finding

Unpinned Global npm Package Installation

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/rgh.js:32

Finding

Windows Shell Command Injection Through Forwarded CLI Arguments

Content

View full analysis

{ if (typeof arg === 'string' && arg.includes(' ') && !arg.startsWith('"')) { return `"${arg}"`; } return arg; }); } const { cmd, shell, fallbackCmd } = resolveExecutable(); function runChild(targetCmd, useShell) { const args = useShell ? sanitizeArgs(process.argv.slice(2)) : process.argv.slice(2); const child = spawn(targetCmd, args, { stdio: 'inherit', env: process.env, shell: useShell, }); ``` The Python wrapper has the same shell boundary for Windows `.cmd` targets: ```python def main(): args = [target_cmd] + sys.argv[1:] try: use_shell = is_win and target_cmd.endswith(".cmd") res = subprocess.run(args, shell=use_shell) sys.exit(res.returncode) ``` ### Technical Analysis On Windows, the JavaScript wrapper resolves the normal fallback to `rgh.cmd` with `shell: true`. The Python wrapper similarly uses `shell=True` when the resolved executable ends in `.cmd`. Arguments are forwarded from `process.argv` or `sys.argv`, and hotel search or booking fields may be derived from user conversation. The JavaScript `sanitizeArgs` function only adds quotes when an argument contains a space. It does not reliably escape Windows command-shell metacharacters or expansion syntax, including `&`, `|`, `<`, `>`, `^`, `%`, and related quoting edge cases. Arguments without spaces are returned unchanged. Manual quoting is also not a complete substitute for the platform-specific parsing and escaping required by `cmd.exe`. Although argument-array APIs are used, enabling the shell reintroduces command parsing. A crafted value can therefore be interpreted as additional shell syntax rather than as data intended solely for t ...[truncated 1211 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose is hotel booking, but the skill also instructs the agent to perform environment management, package installation, binary download, permission changes, remote version checks, and local file writes. That mismatch is dangerous because users and platform policy may authorize a booking assistant but not expect broad system administration and software installation behavior.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md

> - **每日检查**：若当前目录下的 `.version_check` 不存在或记录日期非今天，静默请求远端 `SKILL.md`（地址拼接规则：将元数据中的 `{repository}` 域名替换为 `raw.githubusercontent.com`，并在末尾追加 `/main/skills/{name}/S

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill requires shell, network, and environment access but does not declare any explicit tool scope or permission boundaries. This increases the blast radius of the skill because an agent may execute installation, login, network fetch, and local file operations without a clear least-privilege policy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

L005 的描述与整份技能说明均面向中文场景本身并非问题，但规则要求检查是否强制特定语言。文档中的交互模板和触发要求全部固定为中文，未说明可根据用户偏好切换语言，也未提供语言选择或 opt-in。

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill directs the agent to silently fetch a remote SKILL.md daily and write a .version_check file locally. Silent network access plus local state mutation exceeds the core booking function and can be abused for covert tracking, persistence markers, or unexpected remote-content influence.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill includes undisclosed silent remote requests and local file writes without clearly informing the user of those side effects. Lack of transparency undermines informed consent and can conceal network and filesystem activity that users would not reasonably expect from a hotel-search assistant.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The update instruction uses npx skills without pinning a version, which allows execution of whatever package version is current at runtime. This creates a supply-chain risk where behavior can change unexpectedly or a compromised upstream release could execute arbitrary code in the agent environment.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to run npm and Python installation commands and to download standalone binaries from releases, all within the booking workflow. These actions grant code execution and software installation capabilities unrelated to hotel booking, creating significant supply-chain and host-compromise risk if the installer or downloaded artifacts are malicious or tampered with.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrases are overly broad and include common expressions, increasing the chance the skill activates when the user did not intend to book or search for hotels. In this skill, mistaken activation is more dangerous because the workflow can proceed to login, network access, and potentially commercial actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documented book command collects personally identifiable information including contact email and guest names, but the skill documentation provides no warning, minimization guidance, or handling constraints for this sensitive data. In an agent-driven workflow, that omission increases the chance the agent will solicit, echo, log, or persist PII without clear user consent or privacy safeguards.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The orders and order-detail capabilities expose historical booking records along with contact details, hotel stay data, and order identifiers, yet the documentation includes no warning about sensitive data access or visibility. In a conversational agent context, this can lead to overbroad retrieval or disclosure of prior bookings to the wrong user/session if identity and authorization checks are not emphasized.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/install.py (reported line 13)May include surrounding context.

python

def run_command(args):
    """Run a system command and return exit code and output."""
    try:
        result = subprocess.run(args, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
        return result.returncode, result.stdout, result.stderr
    except Exception as e:
        return -1, "", str(e)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/install.py (reported line 30)May include surrounding context.

python

print("✅ Successfully installed @rollinggo/hotel globally via npm!")
        return True
    
    print("⚠️ npm global installation failed (might need administrator/sudo permissions).")
    print(stderr)
    return False

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The installer fetches release metadata from GitHub and later downloads/install binaries from remote URLs without any authenticity or integrity verification such as signatures or pinned checksums. In an installation script for a hotel-booking skill, this is more dangerous because it introduces a software supply-chain risk unrelated to the core business function and can lead to arbitrary code execution if the upstream release channel or network path is compromised.

Content

Scanner excerpt · scripts/install.py (reported line 65)May include surrounding context.

python

def get_latest_release_assets():
    """Query GitHub API for the latest release assets."""
    api_url = "https://api.github.com/repos/RollingGo-AI/oauth-hotel-cli/releases/latest"
    req = urllib.request.Request(
        api_url,
        headers={'User-Agent': 'RollingGo-Installer/1.0'}

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/install.py (reported line 87)May include surrounding context.

python

# Check if node and npm are available
    has_node = False
    try:
        node_code = subprocess.call(["node", "--version"], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
        npm_code = subprocess.call(["npm" if platform.system() != "Windows" else "npm.cmd", "--version"], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
        has_node = (node_code == 0 and npm_code == 0)
    except Exception:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/install.py (reported line 88)May include surrounding context.

python

has_node = False
    try:
        node_code = subprocess.call(["node", "--version"], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
        npm_code = subprocess.call(["npm" if platform.system() != "Windows" else "npm.cmd", "--version"], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
        has_node = (node_code == 0 and npm_code == 0)
    except Exception:
        has_node = False

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The wrapper will execute any rgh binary found in the local bin directory or on the system PATH, with all user-supplied arguments passed through unchanged. In a skill intended specifically for hotel booking, this creates trust in an external executable outside the reviewed skill code, so a malicious or trojanized rgh on PATH could perform arbitrary actions under the agent's privileges.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/rgh.py (reported line 48)May include surrounding context.

python

args = [target_cmd] + sys.argv[1:]
    try:
        use_shell = is_win and target_cmd.endswith(".cmd")
        res = subprocess.run(args, shell=use_shell)
        sys.exit(res.returncode)
    except KeyboardInterrupt:
        sys.exit(130)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This file contains natural-language comments and console error output in Chinese, including the user-facing messages at L62-L63, with no indication that the skill is Chinese-only or that users can choose a language. That creates a locale policy concern because the script imposes a specific language on users without opt-in or justification.

Content

No source excerpt is available for this finding.