المهارات pricewin-booking-assistant

📦

pricewin-booking-assistant

Name: pricewin-booking-assistant
Author: PriceWin

v1.0.3 مراجعة المحتوى r1 مخاطر عالية 📁 الوصول إلى نظام الملفات⚙️ الأوامر الخارجية🌐 الوصول إلى الشبكة

Book and Manage Hotel Stays

Comparing rooms and completing a booking across providers requires several careful steps. This skill guides discovery, confirmation, payment links, status checks, and cancellation.

يدعم: Claude Codex Code(CC)

⚠️ 38 ضعيف

توقف واطلب التأكيد قبل التثبيت.

راجع الخطة واحصل على موافقة صريحة من المستخدم قبل تغيير الملفات.

التثبيت باستخدام Agent لدي

انسخ هذا الطلب إلى Agent لديك. يتضمن صفحة Skill المعتمدة وملف manifest.

طلب الوكيل

Review the Skillstore skill "pricewin-booking-assistant" from https://skillstore.io/skills/price-win-pricewin-booking-assistant.md and its manifest at https://skillstore.io/api/skills/price-win-pricewin-booking-assistant/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

يجب أن يواصل Agent عرض خطته وطلب أي تأكيد تفرضه سياسة الأمان.

موارد مهيّأة لـ Agents

استخدم هذه الروابط عندما يحتاج AI Agent أو crawler أو script إلى سياق نظيف بدلًا من قراءة الصفحة كاملة.

تفاصيل Markdown GET /skills/price-win-pricewin-booking-assistant.md manifest موقَّع GET /api/skills/price-win-pricewin-booking-assistant/manifest lockfile موقَّع GET /api/skills/price-win-pricewin-booking-assistant/lockfile

اختبرها

جارٍ استخدام "pricewin-booking-assistant". Find a well-reviewed hotel in Da Nang for two adults within 120 USD per night.

النتيجة المتوقعة:

Seaside Central Hotel, rated 8.7 from 1,240 reviews. Deluxe Double costs 108 USD nightly. Free cancellation applies until the displayed deadline.

جارٍ استخدام "pricewin-booking-assistant". Book the selected room using PayPal.

النتيجة المتوقعة:

Please confirm the hotel, room, dates, two guests, full total, guest name, email, phone number, and PayPal before I create the reservation.

جارٍ استخدام "pricewin-booking-assistant". My payment link expired for confirmation code K7X9M2P4.

النتيجة المتوقعة:

I will renew the payment link for the existing reservation. The confirmation code remains K7X9M2P4, so no duplicate booking is created.

التدقيق الأمني

مخاطر عالية

v1 • ١٦‏/٨‏/٢٠٢٦ فتح التقرير المرتبط بالإصدار

The apparent shell execution and path traversal findings are Markdown formatting and relative documentation links, not executable behavior. The material risks are real booking authority and transmission of guest PII and verbatim requests to PriceWin's closed-source hosted service.

الملفات التي تم فحصها

363

الأسطر التي تم تحليلها

عناصر المراجعة

تم تجاهل الإيجابيات الكاذبة

مخاوف أمنية مؤكدة (2)

مرتفع

SKILL.md:89-102

Real-World Booking Authority

The skill creates real hotel reservations and payment links after conversational confirmation. Mistaken or manipulated invocation can create financial and contractual consequences.

The documented flow explicitly gathers booking inputs, requests confirmation, and then calls create_booking to return a live payment link.

مرتفع

SECURITY.md:37-46 SECURITY.md:19-23

PII and Verbatim Request Sent to Closed Backend

The booking flow sends guest name, phone, email, and the user's original request to PriceWin. Verbatim requests may contain unrelated sensitive information.

The security document lists each transmitted field, states that queryText is sent verbatim, and says the hosted server is closed-source.

عناصر مراجعة القدرات (1)

هذه قدرات محلية حقيقية قد يُتوقع وجودها لهذه المهارة، لذا فهي تتطلب مراجعة ولكن لا تُحتسب كسلوك خبيث مؤكد.

مرتفع

SKILL.md:142

Hardcoded URL

phone, email) to PriceWin's hosted MCP server `https://mcp.price.win/mcp` — that

The hosted MCP endpoint receives guest name, phone, email, and booking data. This intentional external transmission creates a real privacy and service-trust risk.

عوامل الخطر

📁 الوصول إلى نظام الملفات (3)

SECURITY.md:28 SECURITY.md:29 SKILL.md:48

⚙️ الأوامر الخارجية (42)

🌐 الوصول إلى الشبكة (2)

SKILL.md:11 SKILL.md:142

دقّقه: codex

شارك واستشهد بهذا التقرير

شارك تقرير التقييم المرتبط بالإصدار والشارة المحايدة وبطاقة التضمين والاستشهادات. تعرض Skillstore الأدلة من دون أن تقرر ما إذا كانت هذه المهارة آمنة.

فتح التقرير المرتبط بالإصدار

نسخ رابط التقرير

https://skillstore.io/skills/price-win-pricewin-booking-assistant/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

شارة Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/price-win-pricewin-booking-assistant/security.svg)](https://skillstore.io/skills/price-win-pricewin-booking-assistant?utm_source=security_passport_badge)

شارة HTML

<a href="https://skillstore.io/skills/price-win-pricewin-booking-assistant?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/price-win-pricewin-booking-assistant/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

بطاقة قابلة للتضمين

<iframe src="https://skillstore.io/embed/skills/price-win-pricewin-booking-assistant.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

الاستشهادات الأكاديمية (APA · BibTeX · CFF)

اقتباس APA

PriceWin. (2026). pricewin-booking-assistant security audit report (audit version 1) [Author version 1.0.3]. Skillstore. https://skillstore.io/skills/price-win-pricewin-booking-assistant/audits/1

اقتباس BibTeX

@techreport{pricewin-price-win-pricewin-booking-assistant-2026,
  author = {PriceWin},
  title = {pricewin-booking-assistant security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/price-win-pricewin-booking-assistant/audits/1},
  note = {Author version 1.0.3}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "pricewin-booking-assistant security audit report (audit version 1)"
version: "1.0.3"
type: report
authors:
  - name: "PriceWin"
date-released: "2026-08-16"
url: "https://skillstore.io/skills/price-win-pricewin-booking-assistant/audits/1"
identifiers:
  - type: other
    value: "skillstore:price-win-pricewin-booking-assistant:audit:1"
    description: "Skillstore immutable audit report identifier"

تقييم Skillstore

سبب هذا التقييم موثوقية الأدلة: متوسط

الهندسة المعمارية

100

قابلية الصيانة

المحتوى

المجتمع

الامتثال للمواصفات

ما الذي يمكنك بناؤه

Reserve a Personal Stay

Compare suitable rooms, review the full total, and create a confirmed reservation with a chosen payment method.

Coordinate Business Travel

Shortlist credible hotels and collect guest details before an authorized employee confirms the booking.

Manage an Existing Reservation

Check payment status, replace an expired payment link, or complete a guest-authorized cancellation.

جرّب هذه الموجّهات

Find a Hotel

Find hotels in [city] from [check-in] to [check-out] for [guest count]. Show three strong options within [budget].

Compare Rooms

Compare available rooms at [hotel] for my dates. Include total price, capacity, rating, review count, and cancellation terms.

Create a Booking

Book the selected OpenTravel room. Ask for all required guest details, show the complete summary, and wait for my explicit confirmation.

Recover or Cancel a Booking

For confirmation code [code], check status first. Renew the payment link if expired, or begin token-protected cancellation when requested.

أفضل الممارسات

Verify current room details and total price immediately before requesting confirmation.
Collect only required guest data and ensure the guest types the email address.
Keep the confirmation code and renew expired links instead of creating another booking.

تجنب

Do not create a booking before the user confirms every detail and the full total.
Do not ask for card numbers, CVV values, bank credentials, or PayPal passwords.
Do not present OTA inventory as booked or construct provider URLs manually.

الأسئلة المتكررة

Which hotels can this skill book directly?

Only OpenTravel direct properties with a property ID and room type ID can be booked through this skill.

Can it book Booking.com, Agoda, or Traveloka rooms?

No. It can show returned provider links, but the user completes those reservations on the provider site.

Does the skill handle card or bank credentials?

No. It returns a hosted payment link, and the user enters payment credentials on the provider page.

What personal data is transmitted?

PriceWin receives the guest name, phone, email, booking details, payment-method choice, and original request text.

What happens when a payment link expires?

The skill renews the link for the existing confirmation code. It must not create a second reservation.

How does cancellation work?

The guest receives a single-use cancellation token by email and must provide it before cancellation can complete.

تفاصيل المطور

المؤلف

PriceWin

الترخيص

MIT

إصدار المؤلف

v1.0.3

مراجعة Skillstore

المستودع

https://github.com/price-win/pricewin-skills-hub/tree/ea022aa512aaf729d9d91ff4f4a0b9a965f6a521/skills/pricewin-booking-assistant

مرجع

45f3d263aa9101b39f66ea71fda13853f0aab6e5

حداثة الصيانة

١٦‏/٨‏/٢٠٢٦

الاستخدام

0 تنزيلات · 0 مشاهدات

بنية الملفات

📄 reference.md

📄 SECURITY.md

📄 skill-card.md

📄 SKILL.md