find-hotel

PassAudited by ClawScan on May 1, 2026.

Overview

This instruction-only hotel-search skill is coherent and purpose-aligned, with normal API-key and external package-install considerations.

This appears appropriate if you want RollingGo-powered hotel search. Before installing, confirm you trust the RollingGo package and homepage, protect the API key, and review any booking links yourself before completing a reservation.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

Anyone with the API key may be able to use the associated hotel API access or quota.

Why it was flagged

The skill uses a service API key to access the RollingGo hotel service. This is expected for the stated purpose, but it is still account/credential authority the user should protect.

Skill content

Resolution order: `--api-key` flag → `AIGOHOTEL_API_KEY` env var.

Recommendation

Set the API key only in a trusted environment, avoid pasting it into shared chats or logs, and rotate it if exposed.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing or running an external CLI gives that package code execution in the user's local environment.

Why it was flagged

The skill depends on an external package named `rollinggo` rather than included reviewed code. This is coherent for a CLI-based skill, but users should verify they are installing the intended package.

Skill content

node | package: rollinggo | creates binaries: rollinggo; uv | package: rollinggo | creates binaries: rollinggo

Recommendation

Install from the expected registry/source, verify the package and homepage, and consider using a pinned version or isolated environment if available.