RollingGo Hotel Search

Hotel search and pricing via the RollingGo CLI. Use when the user wants to search hotels by destination, filter by date/star/budget/tags/distance, inspect ho...

Security Scan

The skill's requirements and instructions are coherent with a CLI-based hotel search wrapper; nothing requested is disproportionate to the stated purpose, though running latest remote packages each run and using a public API key are operational risks to be aware of.

Purpose & Capability

Name/description match the declared needs: it requires a RollingGo CLI (rollinggo) and an API key (AIGOHOTEL_API_KEY), which are exactly what a CLI-based hotel search tool would need. The bundled references and npm/uv install entries all point to the same rollinggo package, so required components align with the stated purpose.

Instruction Scope

SKILL.md instructs only on setting the API key and invoking rollinggo subcommands (search-hotels, hotel-detail, hotel-tags). There are no instructions to read unrelated files, access other credentials, or exfiltrate data to unexpected endpoints. It does recommend exporting a provided public API key into the environment, which is operational but within scope.

Install Mechanism

Install is via npm (npx/npm) or uv/uvx tool, i.e., public package registries — a standard, expected mechanism. Note: the skill's default behavior is to run the latest release on every execution (npx --package rollinggo@latest or uvx --refresh), which means remote code will be executed dynamically; this increases runtime risk compared to using a pinned/local install.

Credentials

Only one credential is required (AIGOHOTEL_API_KEY), which is appropriate. The skill includes a pre-configured public API key for testing; this is convenient but not ideal for production. No unrelated secrets or system config paths are requested.

Persistence & Privilege

always is false and the skill does not request system-wide configuration changes or persistent elevated privileges. Autonomous invocation is allowed (platform default) — combined with the dynamic 'latest release' install behavior this slightly increases attack surface, but not by itself a coherence problem.

Assessment

This skill appears to do what it says, but consider these operational security points before installing/use: (1) It defaults to fetching and running the latest rollinggo package each run via npx/uvx — for production prefer installing a pinned, reviewed version to avoid unexpected remote code execution. (2) The SKILL ships a public API key for testing; request and configure your own key for production to avoid shared quota or data-mixing. (3) If you allow autonomous agent invocation, be aware that running unpinned remote packages increases the blast radius; consider requiring user confirmation before the agent runs CLI installs or networked commands. (4) If you want extra assurance, check the rollinggo package on the npm/uv registries and the project's homepage (https://mcp.agentichotel.cn) before use.

RollingGo Hotel CLI

When to Use

✅ Use this skill when:

• Searching Candidates: User wants to find hotels near a specific city, landmark, or address (e.g., "Find hotels near Tokyo Disneyland").
• Complex Filtering: User needs to narrow down options using natural language queries combined with exact dates, guest count, star ratings, budget limits, or distance radius.
• Tag & Brand Matching: User wants to find hotels with specific attributes (e.g., "family friendly", "breakfast included", "Marriott") by first checking the tag dictionary to build exact filters.
• Deep Dive & Pricing: User wants to inspect detailed room plans, real-time pricing, cancellation policies, or availability for a specific hotel ID.
• Comparison & Evaluation: User wants to compare multiple candidate hotels based on returning structured data and current rates.
• Hotel Booking: User is ready to select a room and book a hotel. The returned booking URLs and detail page links can be provided to guide the user to complete their reservation.

❌ Don't use this skill when:

• User asks about non-hotel travel booking (flights, trains, transfers, car rentals).

API Key

Pre-configured Public API Key:

AIGOHOTEL_API_KEY=mcp_171e1ffa7da343faa4ec43460c52b13f

This skill comes with a pre-configured public API Key. See references/env.md for detailed usage instructions.

Resolution order: --api-key flag → AIGOHOTEL_API_KEY env var

Runtime

Choose based on user's environment. Load the matching reference file and keep it for the session.

• npm, npx, Node, or no preference: Load references/rollinggo-npx.md
• uv, uvx, PyPI, or Python: Load references/rollinggo-uv.md
• API Key setup: Load references/env.md

Default when unspecified → npm/npx (broader env compatibility).

Version Freshness (Always Latest)

Default policy for this skill: use the newest release on every run.

• npm/npx: npx --yes --package rollinggo@latest rollinggo ...
• uvx: uvx --refresh --from rollinggo rollinggo ...

If using an installed command instead of temporary execution, upgrade first:

• npm global: npm install -g rollinggo@latest
• uv tool: uv tool upgrade rollinggo

Primary Workflow

Run these steps in order unless the user is already at a later step.

1. Load API Key: Run export AIGOHOTEL_API_KEY=mcp_171e1ffa7da343faa4ec43460c52b13f
2. Clarify: destination, dates, nights, occupancy, budget, stars, tags, distance
3. If tag filters needed: Run hotel-tags first to get valid tag strings
4. Search: Run search-hotels → parse JSON → extract hotelId
5. Detail: Run hotel-detail --hotel-id <id> for room plans and pricing
6. If results are weak: Loosen filters and retry

Commands Quick Reference

# Setup API Key
export AIGOHOTEL_API_KEY=mcp_171e1ffa7da343faa4ec43460c52b13f

# Discover tags
rollinggo hotel-tags

# Search hotels (minimum required flags)
rollinggo search-hotels \
  --origin-query "<user's natural language request>" \
  --place "<destination>" \
  --place-type "<value from --help>"

# Hotel detail with pricing
rollinggo hotel-detail \
  --hotel-id <id> \
  --check-in-date YYYY-MM-DD \
  --check-out-date YYYY-MM-DD \
  --adult-count 2 --room-count 1

# Discover all flags
rollinggo search-hotels --help
rollinggo hotel-detail --help

Key Rules

• --place-type must use exact values from rollinggo search-hotels --help
• --star-ratings format: min,max e.g. 4.0,5.0
• --format table allowed only on search-hotels; rejected by hotel-detail and hotel-tags
• --child-count must match the count of --child-age flags
• --check-out-date must be later than --check-in-date
• Prefer --hotel-id over --name whenever available

Output

• stdout → result payload (JSON by default)
• stderr → errors only
• Exit 0 success · 1 HTTP/network failure · 2 CLI validation failure
• Results include booking URLs and hotel detail page links for downstream use

Filter Loosening (when no results)

Try in order: remove --star-ratings → increase --size → increase --distance-in-meter → remove tag filters → widen dates or budget