Rollinggo Hotel Booking Skill

• Outcome: Review
• Latest audit: Jul 22, 2026 · 3:55 AM UTC
• Version: 0.1.0

Overview

This hotel booking skill is mostly purpose-aligned, but it uses unpinned install/update paths and can create real booking orders with sensitive account data, so users should review it carefully before installing.

Install only if you trust RollingGo and are comfortable authorizing an external hotel service, installing or updating its CLI, and allowing the agent to retrieve booking/order details. Before any booking, verify dates, room, price, cancellation terms, guest name, and payment link, and avoid sharing order history unless you explicitly asked for it.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill invokes shell commands and performs network access but does not declare permissions, preventing users or platforms from understanding the actual trust boundary before execution. In this skill, those capabilities are significant because they are used for installation, login, update checks, and remote booking operations.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The stated purpose is hotel search and booking, but the skill also instructs the agent to install software globally, download binaries from GitHub, detect the environment, write executables, and change file permissions. This mismatch is dangerous because users may consent to a travel assistant without realizing it can modify the local system and fetch code from remote sources.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger scope is broad enough to activate on common accommodation-related phrases, which can cause the skill to run unexpectedly. Because this skill can initiate login flows, network lookups, and booking-related operations, accidental activation increases the chance of unintended data access or transactional actions.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation describes a `book` command that creates an official order and returns a payment link, but it does not clearly warn that invoking it has real-world transactional effects. In an agent setting, this increases the risk of unintended purchases or social-engineering-style prompting where a user may not realize the action is committing them to a reservation workflow.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The `orders` command exposes historical booking data, including names, hotel stays, dates, addresses, order numbers, and payment status, but the documentation provides no privacy warning or usage constraint. In an agent context, this can normalize over-collection or over-disclosure of sensitive travel history to users or downstream logs without adequate notice.

External Transmission

Medium

• Category: Data Exfiltration

Content

def get_latest_release_assets():
    """Query GitHub API for the latest release assets."""
    api_url = "https://api.github.com/repos/RollingGo-AI/oauth-hotel-cli-overseas/releases/latest"
    req = urllib.request.Request(
        api_url,
        headers={'User-Agent': 'RollingGo-Installer/1.0'}

• Confidence: 90% confidence
• Finding: https://api.github.com/

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

After downloading, rename it to `rgg` (or `rgg.exe` on Windows), grant execution permissions, and place it in the system PATH or the skill directory's `bin` folder.

**⚠️ Auto-Update Interception Principle:**
The CLI tool has built-in version detection. When you execute any `rgg` command, if the console output prompts `📦 New version available!` or `Run the following command to update`, **you must immediately pause the current operation, use one of the above three methods to upgrade the tool to the latest version, and then re-execute the interrupted command.** This prevents booking failures due to expired server endpoints.

---

• Confidence: 90% confidence
• Finding: output prompt

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.