Security audit

hotel-recommendation

Security checks for vulnerabilities and agentic risk

Overview

This hotel-search skill is not malicious, but it needs review because it directs agents to run unpinned latest RollingGo packages and gives weaker API-key handling options.

Before installing, pin RollingGo to a reviewed version instead of using @latest, avoid global upgrades during normal skill use, inject the API key only for this skill where possible, and avoid putting the key on command lines or in broad host/sandbox environment settings.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:57
Finding: Automatic Execution of Unpinned RollingGo Packages
Content: View full analysis
" npm install -g rollinggo@latest rollinggo --help ``` Equivalent instructions in `references/rollinggo-uv.md` include: ```bash uvx --refresh --from rollinggo@latest rollinggo --help uvx --refresh --from rollinggo@latest rollinggo search-hotels \ --origin-query "Find hotels near Tokyo Disneyland" \ --place "Tokyo Disneyland" --place-type "" uv tool install rollinggo@latest uv tool upgrade rollinggo@latest rollinggo --help ``` ### Technical Analysis The Skill explicitly requires resolving and executing the current `latest` release from npm or PyPI. This is a mutable dependency reference: the package that executes can change after the Skill itself has been reviewed. The `npx --yes` option suppresses installation confirmation, while `uvx --refresh` deliberately refreshes the resolved package. The documentation does not require an exact reviewe ...[truncated 2136 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/claw-host-env.md:12
Finding: API Key Exposure Through Command-Line Arguments and Overbroad Plaintext Injection
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (20)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest description is entirely in Chinese and describes the skill's trigger and usage without indicating that other languages are supported or that the user can choose their preferred language. This creates a natural-language policy concern because the skill appears to impose a specific language/locale without opt-in.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The metadata declares RollingGo_API_KEY while the operational instructions repeatedly require ROLLINGGO_API_KEY. This inconsistency can cause the skill to miss an existing credential, fail closed unpredictably, or push operators to duplicate or manually pass secrets, increasing the chance of accidental secret exposure in command arguments, logs, or troubleshooting steps.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The skill explicitly instructs use of rollinggo@latest via npx, which fetches and executes whatever package version is current at runtime. This creates a supply-chain risk: a compromised publisher account, malicious update, or dependency hijack could result in arbitrary code execution in the agent environment.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The uvx --refresh --from rollinggo@latest rollinggo ... instruction forces retrieval of the latest package version at execution time, again allowing unreviewed code to run. In an agent skill that may be triggered automatically, this materially increases exposure to remote package compromise and unexpected behavior changes.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The document instructs users to execute npx --yes --package rollinggo@latest, which fetches and runs the latest package version at execution time without version pinning or integrity verification. In a skill context, this directly increases supply-chain risk: a compromised maintainer account, malicious publish, or dependency hijack could result in arbitrary code execution on the host.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: This line repeats guidance to run rollinggo@latest via npx, which causes unreviewed remote code to be executed each time. Because this is operational documentation for a skill, users are likely to copy-paste it verbatim, making exploitation practical if the package or its dependencies are ever poisoned.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This section explicitly requires using npx ... rollinggo@latest on every run but does not warn that this executes the newest registry-published code without pinning. In the context of an agent skill that may be run automatically or by copy-paste, this meaningfully elevates the risk of arbitrary code execution through supply-chain compromise.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The "default latest-version prefix" explicitly normalizes npx --yes --package rollinggo@latest rollinggo, reinforcing unsafe execution of the newest registry code. In this skill context, that is more dangerous than a casual mention because it establishes @latest as the recommended standard workflow.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation shows passing the API key directly on the command line (--api-key YOUR_API_KEY) but does not warn that command-line arguments may be exposed via shell history, process listings, CI logs, or telemetry. In a host/agent environment, that can leak long-lived credentials to other local users or logging systems.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: This line continues recommending the same unpinned npx execution pattern for normal use. Repetition across the document increases the chance users adopt insecure copy-paste behavior and makes the skill an amplifier for npm supply-chain compromise.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The troubleshooting guidance again directs users to npx ... rollinggo@latest, perpetuating execution of unpinned remote code even in error-recovery situations. Troubleshooting instructions are often followed under time pressure, which further raises the likelihood of unsafe execution without review.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The document instructs users to run uvx --refresh --from rollinggo@latest rollinggo ..., which always resolves and executes the newest package release instead of a fixed, reviewed version. If the upstream package is compromised, typosquatted, or a malicious update is published, users will automatically fetch and run attacker-controlled code at invocation time.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: This example again recommends execution via rollinggo@latest, causing runtime trust in whatever package version is most recently published. In an agent skill context, this is especially risky because the agent may follow the reference literally and repeatedly execute newly published code without human review.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The 'version freshness' section explicitly sets a policy of always using the latest published PyPI version, which is a supply-chain risk rather than a one-off example. This operationalizes unreviewed remote code execution whenever the tool is used.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documentation shows passing the API key directly on the command line (--api-key YOUR_API_KEY) and setting it in shell sessions without warning about shell history, process listings, logging, or shared terminal exposure. In agent or hosted environments, these patterns can leak credentials to transcripts, telemetry, other local users, or debugging output.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The hotel-tags example uses the same latest-version execution pattern, so even read-only looking commands still require trust in arbitrary newly published code. Attackers exploiting package compromise could steal environment secrets such as RollingGo_API_KEY or execute additional payloads on the host.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The troubleshooting guidance recommends installing/upgrading with rollinggo@latest, reinforcing unsafe supply-chain behavior during error recovery when users are likely to copy-paste commands quickly. This widens exposure because troubleshooting paths are commonly followed without scrutiny.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Using uvx --refresh --from . rollinggo --help in local development refreshes and executes from the local source tree rather than a reviewed release. In a dev setting this is somewhat expected, but it still increases risk if the working directory or checked-out repository contents are untrusted or tampered with.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.