Security audit

book-hotels

Security checks for vulnerabilities and agentic risk

Overview

This hotel-search skill is purpose-aligned, but it repeatedly tells agents to download and run the latest remote CLI package and exposes weaker API-key handling patterns.

Install only if you are comfortable with an agent running the RollingGo CLI from mutable latest package releases. Prefer a pinned reviewed version, avoid global installs, inject only the RollingGo API key through scoped environment configuration, and do not put real API keys directly on the command line.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:57
Finding: Unpinned Third-Party Packages Are Automatically Downloaded and Executed
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:57-66; references/rollinggo-npx.md:21-37,52-62; references/rollinggo-uv.md:21-36,53-63
Vulnerability Type: Supply-chain exposure through unpinned runtime dependencies
Risk Level: High

Vulnerable Code

SKILL.md:57-66:

bash
# npm/npx npx --yes --package rollinggo@latest rollinggo ... # uvx uvx --refresh --from rollinggo@latest rollinggo ... # npm global installation npm install -g rollinggo@latest # uv tool uv tool upgrade rollinggo@latest

references/rollinggo-npx.md:21-37:

bash
npx --yes --package rollinggo@latest rollinggo --help npx --yes --package rollinggo@latest rollinggo search-hotels --origin-query "..." --place "Tokyo Disneyland" --place-type "value from help" npm install -g rollinggo@latest rollinggo --help npm install -g rollinggo@latest

references/rollinggo-uv.md:21-36:

bash
uvx --refresh --from rollinggo@latest rollinggo --help uvx --refresh --from rollinggo@latest rollinggo search-hotels \ --origin-query "Find hotels near Tokyo Disneyland" \ --place "Tokyo Disneyland" --place-type "value from help" uv tool install rollinggo@latest uv tool upgrade rollinggo@latest rollinggo --help

Technical Analysis

The Skill explicitly instructs the agent to resolve and execute the latest release of the rollinggo package from npm or PyPI on every use. No exact package version, lockfile, checksum, signature, or integrity metadata is supplied by the audited project.

The npx --yes option suppresses interactive installation confirmation. The uvx --refresh option forces dependency metadata and artifacts to be refreshed. Consequently, the code executed by the Skill can change after the Skill itself has been audited, without any modification to this repository.

The global npm and uv installation alternatives also modify the host tool environment. If performed from a privile ...[truncated 2116 chars]
Remediation: View remediation
Remediation Suggestions

Replace every rollinggo@latest reference with an exact, reviewed version.

Provide lockfiles and registry-supported integrity hashes for all transitive dependencies.

Remove the policy requiring an upgrade or refresh before every invocation.

Establish a controlled update process in which new releases are reviewed, scanned, tested, and explicitly approved before changing the pinned version.

Avoid global package installation. Prefer an isolated, nonpersistent environment with a dedicated package cache.

Run the CLI in a sandbox under an unprivileged account with read-only filesystem access wherever possible.

Expose only RollingGo_API_KEY to the subprocess rather than the agent's complete environment.

Restrict outbound network access to verified RollingGo service endpoints and package registries needed during a controlled installation phase.

Separate dependency acquisition from normal Skill execution so routine hotel searches do not download executable code.

Verify package provenance or signatures when supported by the relevant registry and package manager.

T09 · Insecure Skill Coding Practices

Warning

Location: references/rollinggo-npx.md:69
Finding: API Key May Be Exposed Through Command-Line Arguments
Content: View full analysis
Vulnerability Details

File Location: references/rollinggo-npx.md:69-80,143-145; references/rollinggo-uv.md:70-81,144-146
Vulnerability Type: Sensitive credential exposure through process arguments and command history
Risk Level: Medium

Vulnerable Code

references/rollinggo-npx.md:69-80:

bash
# Bash / zsh export RollingGo_API_KEY="YOUR_API_KEY" # PowerShell $env:RollingGo_API_KEY="YOUR_API_KEY" # Specify it temporarily for one command rollinggo hotel-tags --api-key YOUR_API_KEY

references/rollinggo-npx.md:143-145:

bash
rollinggo hotel-tags rollinggo hotel-tags --api-key YOUR_API_KEY

references/rollinggo-uv.md:70-81:

bash
# Bash / zsh export RollingGo_API_KEY="YOUR_API_KEY" # PowerShell $env:RollingGo_API_KEY="YOUR_API_KEY" # Specify it temporarily for one command rollinggo hotel-tags --api-key YOUR_API_KEY

references/rollinggo-uv.md:144-146:

bash
rollinggo hotel-tags rollinggo hotel-tags --api-key YOUR_API_KEY

Technical Analysis

The documentation presents --api-key as a supported credential delivery method and gives examples that place the credential directly in the process argument list.

Command-line secrets can be exposed through shell history, process inspection interfaces, terminal transcripts, agent tool-call logs, telemetry, diagnostic reports, and command auditing systems. Depending on the operating system and process isolation configuration, other local users or processes may be able to observe command arguments while the process is running.

This exposure is unnecessary because the Skill already supports RollingGo_API_KEY through scoped environment injection. Although environment variables also require careful handling, they avoid placing the key directly in ordinary command histories and process command lines.

Attack Path

A user or agent replaces YOUR_API_KEY with a valid RollingGo crede ...[truncated 1098 chars]
Remediation: View remediation
Remediation Suggestions

Remove all examples that pass real credentials through --api-key.

Prefer the documented per-Skill RollingGo_API_KEY injection mechanism rather than host-wide environment injection.

Retrieve the value from a protected secret manager at runtime and expose it only to the specific CLI subprocess.

Ensure agent logs, command traces, error messages, and telemetry redact credential values.

Do not enable shell tracing while credentials are being configured or used.

Avoid host-wide .env storage where possible. If file-based storage is unavoidable, restrict ownership and permissions to the service account.

Keep shell environment importing disabled by default because it may expose unrelated host credentials to the agent process.

Document immediate key revocation and rotation procedures for credentials accidentally entered on a command line.

If command-line credential support must remain in the CLI for compatibility, mark it as unsafe for interactive and agent use and omit it from recommended workflows.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (20)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Using the broad trigger term rollinggo may cause the skill to activate in contexts where the user did not clearly request a hotel search. In this skill, unintended invocation is less severe than code injection, but it can still prompt unnecessary CLI execution and external network requests, increasing exposure to the other supply-chain and credential-handling risks present in the skill.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The metadata declares RollingGo_API_KEY while the pre-flight check requires ROLLINGGO_API_KEY, creating inconsistent security-critical configuration. This mismatch can cause the guard check to fail open or fail closed depending on the host implementation, leading to broken authentication handling, accidental unauthenticated requests, or confusion that encourages unsafe workarounds.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The skill instructs use of rollinggo@latest, which is not a pinned, immutable version and allows the executed package to change over time. If the upstream package is compromised or a malicious release is published, users invoking the skill may execute attacker-controlled code in their local environment.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The uvx --refresh --from rollinggo@latest instruction fetches and runs the newest remote package each time, creating a supply-chain execution risk. In a skill that is meant to launch CLI tools, this is especially dangerous because it directly turns remote package publication into code execution on the host.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The entire skill reference is written in Chinese and does not offer an alternate language or indicate that the skill is intended only for a Chinese-speaking or region-specific audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The documentation instructs users to execute npx --yes --package rollinggo@latest ..., which always pulls and runs the newest published package version without pinning. This creates a supply-chain risk: if the package is compromised, typo-squatted, or a malicious update is published, users may immediately execute attacker-controlled code in their environment.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: This line again promotes direct execution of rollinggo@latest through npx, causing remote code to be fetched and run at invocation time. In a skill context, this is more dangerous because agents or users may follow the command verbatim, making compromise of the npm package immediately actionable.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The file explicitly states a 'default rule' of always using the npm latest published version. That guidance normalizes unsafe execution of unreviewed package updates and materially increases supply-chain exposure for every run.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation shows the API key being passed directly on the command line (--api-key YOUR_API_KEY) without warning that command-line arguments may be exposed via shell history, process listings, audit logs, or telemetry. In shared systems, CI runners, or agent-hosted environments, this can lead to credential disclosure and unauthorized API usage.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: This section reiterates that the 'latest version default prefix' is npx --yes --package rollinggo@latest rollinggo, again encouraging execution of unpinned remote code. Repetition across the reference increases the chance users or agents adopt the unsafe pattern as standard practice.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The troubleshooting section recommends falling back to npx --yes --package rollinggo@latest ..., which preserves the same unpinned execution risk even when users are under pressure to 'just make it work'. In troubleshooting contexts, users are especially likely to copy-paste commands without scrutiny.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The document instructs users to run uvx --refresh --from rollinggo@latest, which fetches and executes the latest published package at runtime rather than a fixed, reviewed version. This creates a supply-chain risk: if the upstream package is compromised or a malicious version is published, users of the skill may immediately execute attacker-controlled code.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: This command again relies on rollinggo@latest, causing dynamic resolution and execution of whatever version is most recently published. In an agent skill context, this is particularly dangerous because the skill may be invoked repeatedly and automatically, expanding the blast radius of a poisoned release.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The 'default rule' says every execution should use the latest PyPI release, normalizing unreviewed remote code execution as standard operation. This weakens reproducibility and makes compromise of the package registry or maintainer account immediately exploitable.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file describes passing API keys via CLI arguments, environment variables, and host-level injection, but gives no warning about secret handling, logging, shell history, process-list exposure, or least-privilege storage. In agent or hosted environments, this increases the likelihood of credential leakage through transcripts, debug logs, misconfigured host settings, or observable command lines.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The temporary execution example again instructs use of uvx --refresh --from rollinggo@latest, which retrieves fresh code on demand from an external source. Because this skill is for hotel lookup and not package management, there is no contextual necessity to accept this level of supply-chain exposure by default.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The troubleshooting guidance repeats the recommendation to run the latest remote package when the binary is missing. This trains users to solve local issues by executing unpinned code from the network, which can be abused if the package supply chain is compromised.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 65% confidence
Finding: uvx/uv tool run commands without ==version create a rug-pull risk.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T08 · Insecure Dependencies

Vulnerability Details

Vulnerable Code

Technical Analysis

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

Vague Triggers

Intent-Code Divergence

Rp1

Rp1

Natural-Language Policy Violations

Rp1

Rp1

Rp1

Rp1

Rp1

Missing User Warnings

Rp1

Rp1

Rp1

Rp1

Rp1

Missing User Warnings

Rp1

Rp1

Rp1