RollingGo全球酒店预订Skill-新版本1.1.1

• Outcome: Review
• Latest audit: Jul 22, 2026 · 3:55 AM UTC
• Version: 1.1.1

Overview

This hotel-booking skill is mostly purpose-aligned, but it combines real transaction authority with broad activation, automatic update checking, and unverified latest-version installs that users should review before installing.

Install only if you trust RollingGo and are comfortable with an OAuth-connected CLI that can search hotels, lock prices, create payable orders, and view order history. Before booking, require the agent to summarize the hotel, dates, room, total price, cancellation policy, and contact email, and do not allow automatic updates or downloads unless you accept the supply-chain risk.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill uses shell execution and network access but does not declare corresponding permissions, reducing transparency and weakening host-side policy enforcement. In this context, the capability is real: the skill performs installs, remote fetches, login flows, and CLI invocations, so the missing declaration can cause users or platforms to underestimate its operational reach.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The stated purpose is hotel search/booking, but the documented behavior also installs packages globally, downloads executables, performs environment detection, queries remote release metadata, and modifies local files. This mismatch is dangerous because users and orchestration systems may authorize a travel skill without realizing it can change the local environment and introduce supply-chain risk.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill instructs the agent to silently fetch a remote SKILL.md daily and write a local marker file regardless of user request. That creates unnecessary network egress and filesystem side effects unrelated to the immediate hotel-booking task, and it opens a path for remote content changes to influence future behavior.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The trigger wording is extremely broad for a skill that can initiate real-world hotel transactions, so ordinary travel-planning requests could activate booking-related tooling before the user understands the consequences. Although the README describes confirmation gates, broad invocation language increases the chance that an agent will enter the transactional workflow too early, exposing booking links, account data, or progressing toward a purchase with insufficient user intent validation.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The agent guidance says to use `rgh` commands when the user asks to book hotels, search rooms, or check orders, but it does not define strong intent-disambiguation rules or require explicit opt-in before account-linked or transactional operations. In a skill connected to a live booking system, ambiguous natural-language routing can cause over-eager tool invocation, especially for order lookup or price-lock steps that affect user privacy or commercial state.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The trigger conditions are overly broad, covering many generic travel and lodging phrases and even weakly related conversational contexts. Overbroad activation increases the chance of unintended execution of networked booking logic, login prompts, or data collection in situations where the user did not clearly ask to use this skill.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill writes a .version_check file into the current working directory without prior disclosure or clear scoping. Unannounced filesystem writes can pollute user directories, interfere with other workflows, and create persistence or tracking artifacts outside the core booking function.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill writes a .version_check file into the current working directory without prior disclosure or clear scoping. Unannounced filesystem writes can pollute user directories, interfere with other workflows, and create persistence or tracking artifacts outside the core booking function.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The documented `book` command creates a real hotel order using personal contact data (`first-name`, `last-name`, `email`) but the interface specification shown here contains no explicit requirement to obtain fresh user confirmation immediately before submission. In an agent setting, that omission is dangerous because a model could proceed from conversational context into an irreversible purchase flow, exposing PII to the booking provider and generating a payable order without the user fully realizing they are authorizing a real transaction.

External Transmission

Medium

• Category: Data Exfiltration

Content

def get_latest_release_assets():
    """Query GitHub API for the latest release assets."""
    api_url = "https://api.github.com/repos/RollingGo-AI/oauth-hotel-cli/releases/latest"
    req = urllib.request.Request(
        api_url,
        headers={'User-Agent': 'RollingGo-Installer/1.0'}

• Confidence: 91% confidence
• Finding: The installer reaches out to the GitHub API to discover the latest release and then later downloads a binary from release URLs without any integrity verification such as checksums or signatures. In an installer, this creates a supply-chain risk: if the upstream account, release asset, or network trust boundary is compromised, a malicious binary could be fetched and executed by the user.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.