{"data":{"skill":{"slug":"rollinggo-ai-rollinggo-searchhotel","name":"rollinggo-searchhotel","icon":"📦","repo":"https://github.com/RollingGo-AI/rollinggo-skills/tree/main/rollinggo-hotel-cn/","status":"approved","author":"RollingGo-AI","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"10688d99-4e75-40b7-8dbe-328a6507f750","skill_id":"68213739-2553-45b7-b747-093af333622f","version":1,"content_hash":"b14a82509a0dd9795c2a2f20f8cb3148","risk_level":"low","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"All 252 static findings are false positives. The skill is a legitimate hotel search CLI wrapper that executes documented RollingGo CLI commands. External command patterns flagged are markdown documentation strings, not executable code. API key access is expected and used only for official RollingGo API authentication. No malicious intent or data exfiltration detected.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"references/claw-host-env.md","line_end":45,"line_start":1},{"file":"references/rollinggo-npx.md","line_end":208,"line_start":1},{"file":"references/rollinggo-uv.md","line_end":213,"line_start":1},{"file":"SKILL.md","line_end":97,"line_start":77}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[{"title":"External Command Execution via CLI Tool","locations":[{"file":"references/rollinggo-npx.md","line_end":24,"line_start":22},{"file":"references/rollinggo-uv.md","line_end":29,"line_start":25},{"file":"SKILL.md","line_end":96,"line_start":78}],"confidence":0.25,"description":"The skill executes external CLI commands (rollinggo) to query hotel data. This is legitimate tool usage for a hotel search API wrapper. Commands are hardcoded CLI invocations with user-provided arguments (search queries, dates, hotel IDs) passed as parameters to the rollinggo CLI tool.","confidence_reasoning":"Pattern flagged as 'external_commands' but these are documented CLI tool invocations in markdown files. No actual command injection vectors exist. The skill wraps a legitimate hotel search API."}],"dangerous_patterns":[],"files_scanned":4,"total_lines":584,"audit_model":"claude","audited_at":"2026-05-06T09:15:07.358+00:00","created_at":"2026-05-06T10:43:08.563035+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":1,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}