المهارات pricewin-hotel-deal-finder
📦
pricewin-hotel-deal-finder
v1.1.3 مراجعة المحتوى r1 مخاطر عالية ⚡ يحتوي على سكربتات⚙️ الأوامر الخارجية🌐 الوصول إلى الشبكة📁 الوصول إلى نظام الملفات🔑 متغيرات البيئة
Compare Live Hotel Prices Across Major Sources
Checking several hotel sites takes time and produces inconsistent currencies. This skill searches four sources and presents comparable nightly rates with booking links.
يدعم: Claude Codex Code(CC)
توقف واطلب التأكيد قبل التثبيت.
راجع الخطة واحصل على موافقة صريحة من المستخدم قبل تغيير الملفات.
التثبيت باستخدام Agent لدي
انسخ هذا الطلب إلى Agent لديك. يتضمن صفحة Skill المعتمدة وملف manifest.
طلب الوكيل
Review the Skillstore skill "pricewin-hotel-deal-finder" from https://skillstore.io/skills/price-win-pricewin-hotel-deal-finder.md and its manifest at https://skillstore.io/api/skills/price-win-pricewin-hotel-deal-finder/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.يجب أن يواصل Agent عرض خطته وطلب أي تأكيد تفرضه سياسة الأمان.
موارد مهيّأة لـ Agents
استخدم هذه الروابط عندما يحتاج AI Agent أو crawler أو script إلى سياق نظيف بدلًا من قراءة الصفحة كاملة.
اختبرها
جارٍ استخدام "pricewin-hotel-deal-finder". Find Tokyo hotels for August 12 to 15 for two adults.
النتيجة المتوقعة:
A ranked hotel list with nightly USD prices, compared sources, savings differences, and direct booking links.
جارٍ استخدام "pricewin-hotel-deal-finder". Compare Bangkok hotel rates below 100 USD per night.
النتيجة المتوقعة:
Available lower-priced options grouped by source, plus a clear note when one provider returns no inventory.
جارٍ استخدام "pricewin-hotel-deal-finder". Check Booking.com and Agoda prices for a three-night stay in Paris.
النتيجة المتوقعة:
A ranked list of observed rates from available sources, with links for hotels that returned booking URLs.
التدقيق الأمني
مخاطر عاليةv1 • ١٦/٨/٢٠٢٦ فتح التقرير المرتبط بالإصدار
Static alerts were false positives caused by template literals, fixed local spawns, expected network and cache activity, loopback services, documentation, and lockfile integrity hashes. Semantic review found high-risk anti-bot evasion and automatic sandbox removal under Linux root. It also found unsafe URL scheme validation, raw snapshot exposure, unsupported ranking labels, and incomplete currency conversion.
12
الملفات التي تم فحصها
2,542
الأسطر التي تم تحليلها
0
عناصر المراجعة
0
تم تجاهل الإيجابيات الكاذبة
مخاوف أمنية مؤكدة (6)
مرتفع
Stealth Automation Evades OTA Bot Detection
The skill deliberately masks browser automation and directs agents to use the stealth path because normal browser automation is detected. This bypasses provider anti-bot controls and may violate access policies.
Both files explicitly describe fingerprint masking, avoiding bot detection, and using Patchright because standard automation is blocked.
مرتفع
Chromium Sandbox Automatically Disabled for Linux Root
The daemon adds --no-sandbox whenever it runs as root on Linux. A compromised or malicious hotel page would then execute without Chromium sandbox isolation in a privileged process.
The root check directly adds --no-sandbox before launching Chromium, and the daemon loads remote OTA pages.
متوسط
URL Scheme Allowlist Uses an Unsafe Prefix Check
cleanLink claims to allow only HTTP and HTTPS, but startsWith("http") also accepts custom schemes such as httpx. Untrusted provider links can reach formatted output without an exact protocol check.
The implementation checks a string prefix before URL parsing and never verifies that protocol is exactly http: or https:.
متوسط
Raw Browser Snapshots Can Expose Indirect Prompt Injection
The snapshot command serializes page text and attributes and prints them for agent use without sanitizeText. A hostile page can place model-directed instructions in this output if the command is used directly.
The snapshot path returns arbitrary visible page text to stdout; the one-shot search avoids exposing it, but the public CLI command remains available.
متوسط
Quality and Value Labels Are Based Only on Price
Hotels are sorted only by minimum observed price, then the first three are labeled BEST VALUE, CHEAPEST, and QUALITY. The documented output has no rating or area data to support quality claims.
The ranking expression uses only prices, while the documentation explicitly states that star ratings and area data are unavailable.
متوسط
Non-USD and Non-VND Prices Are Misclassified as USD
The extractor recognizes EUR, GBP, THB, and JPY, but toUSD converts only VND and treats every other currency amount as USD. Localized searches can produce materially incorrect comparisons.
The detected currency enum includes five non-USD currencies, while conversion logic has only a VND branch and an assume-USD fallback.
عوامل الخطر
⚡ يحتوي على سكربتات (3)
⚙️ الأوامر الخارجية (50)
bin/browse.js:16 bin/browse.js:98 bin/browse.js:6 bin/browse.js:11 bin/browse.js:52 bin/browse.js:63 bin/browse.js:74 bin/browse.js:75 bin/browse.js:82 bin/browse.js:126 bin/browse.js:162 bin/browse.js:171 bin/browse.js:182 bin/browse.js:183 bin/browse.js:192 bin/browse.js:202 bin/browse.js:204 bin/browse.js:206 bin/browse.js:213 bin/browse.js:229 bin/browse.js:351 bin/browse.js:377 bin/browse.js:387 bin/browse.js:409 bin/browse.js:477 bin/daemon.js:8 bin/daemon.js:9 bin/daemon.js:14 bin/daemon.js:17 bin/daemon.js:79 bin/daemon.js:90 bin/daemon.js:105 bin/daemon.js:156 bin/daemon.js:176 bin/daemon.js:192 bin/daemon.js:244 bin/daemon.js:275 bin/daemon.js:296 bin/daemon.js:315 bin/daemon.js:317 bin/daemon.js:395 bin/daemon.js:477 bin/daemon.js:520 bin/daemon.js:539 bin/daemon.js:562 bin/daemon.js:576 bin/daemon.js:591 bin/search.js:12 bin/search.js:28 bin/search.js:32
🌐 الوصول إلى الشبكة (38)
bin/browse.js:63 bin/browse.js:75 bin/browse.js:347 bin/browse.js:373 bin/browse.js:320 bin/browse.js:322 bin/browse.js:37 bin/browse.js:63 bin/browse.js:75 bin/browse.js:63 bin/browse.js:75 bin/daemon.js:473 bin/daemon.js:211 bin/daemon.js:53 bin/daemon.js:223 bin/daemon.js:53 bin/daemon.js:54 bin/daemon.js:59 bin/daemon.js:199 bin/daemon.js:212 bin/daemon.js:574 bin/search.js:78 bin/search.js:78 bin/search.js:107 bin/search.js:108 bin/search.js:355 bin/search.js:437 bin/search.js:484 package-lock.json:23 package-lock.json:37 package-lock.json:55 package.json:9 package.json:12 package.json:15 SKILL.md:15 SKILL.md:17 SKILL.md:60 SKILL.md:110
📁 الوصول إلى نظام الملفات (44)
bin/browse.js:397 bin/browse.js:24 bin/browse.js:33 bin/browse.js:113 bin/browse.js:113 bin/daemon.js:546 bin/daemon.js:32 bin/daemon.js:33 bin/daemon.js:34 bin/daemon.js:16 bin/daemon.js:16 bin/search.js:146 bin/search.js:160 bin/search.js:165 bin/search.js:172 bin/search.js:175 bin/search.js:200 bin/search.js:217 bin/search.js:469 install.sh:24 install.sh:24 lib/browser-state.js:42 lib/browser-state.js:45 lib/browser-state.js:50 lib/browser-state.js:59 lib/browser-state.js:8 lib/browser-state.js:8 lib/dom-extract.js:54 lib/dom-extract.js:55 lib/dom-extract.js:56 lib/dom-extract.js:57 lib/dom-extract.js:58 lib/selector-cache.js:55 lib/selector-cache.js:63 lib/selector-cache.js:15 lib/selector-cache.js:15 lib/snapshot.js:65 lib/snapshot.js:71 SECURITY.md:41 SECURITY.md:76 SECURITY.md:41 SECURITY.md:76 SKILL.md:73 SKILL.md:73
دقّقه: codex
شارك واستشهد بهذا التقرير
شارك تقرير التقييم المرتبط بالإصدار والشارة المحايدة وبطاقة التضمين والاستشهادات. تعرض Skillstore الأدلة من دون أن تقرر ما إذا كانت هذه المهارة آمنة.
نسخ رابط التقرير
https://skillstore.io/skills/price-win-pricewin-hotel-deal-finder/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportشارة Markdown
[](https://skillstore.io/skills/price-win-pricewin-hotel-deal-finder?utm_source=security_passport_badge)شارة HTML
<a href="https://skillstore.io/skills/price-win-pricewin-hotel-deal-finder?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/price-win-pricewin-hotel-deal-finder/security.svg" alt="Skillstore security assessment" loading="lazy"></a>بطاقة قابلة للتضمين
<iframe src="https://skillstore.io/embed/skills/price-win-pricewin-hotel-deal-finder.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>الاستشهادات الأكاديمية (APA · BibTeX · CFF)
اقتباس APA
PriceWin. (2026). pricewin-hotel-deal-finder security audit report (audit version 1) [Author version 1.1.3]. Skillstore. https://skillstore.io/skills/price-win-pricewin-hotel-deal-finder/audits/1اقتباس BibTeX
@techreport{pricewin-price-win-pricewin-hotel-deal-finder-2026,
author = {PriceWin},
title = {pricewin-hotel-deal-finder security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/price-win-pricewin-hotel-deal-finder/audits/1},
note = {Author version 1.1.3}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "pricewin-hotel-deal-finder security audit report (audit version 1)"
version: "1.1.3"
type: report
authors:
- name: "PriceWin"
date-released: "2026-08-16"
url: "https://skillstore.io/skills/price-win-pricewin-hotel-deal-finder/audits/1"
identifiers:
- type: other
value: "skillstore:price-win-pricewin-hotel-deal-finder:audit:1"
description: "Skillstore immutable audit report identifier"
تقييم Skillstore
سبب هذا التقييم موثوقية الأدلة: متوسط 55
الهندسة المعمارية
100
قابلية الصيانة
85
المحتوى
65
المجتمع
91
الامتثال للمواصفات
ما الذي يمكنك بناؤه
Plan a personal trip
Compare nightly rates across several sources before choosing a hotel.
Check a travel budget
Find lower-priced stays for fixed dates and a defined guest count.
Research accommodation options
Review source coverage and booking links for a destination shortlist.
جرّب هذه الموجّهات
Basic city search
Find hotel prices in {city} from {check_in} to {check_out} for {adults} adults.Budget comparison
Compare hotel rates in {city} for {dates}. Highlight options near {nightly_budget} per night.Source comparison
Search {city} for {dates} and compare returned hotels across Booking.com, Agoda, Google Hotels, and OpenTravel.Advanced localized search
Search {city} for {dates}, {adults} adults, and locale {locale}. Report partial sources and preserve valid booking links.أفضل الممارسات
- Provide an exact city, check-in date, check-out date, and adult count.
- Verify taxes, cancellation terms, room type, and final totals on the booking page.
- Treat missing sources as partial coverage and retry only when current prices are essential.
تجنب
- Do not treat displayed rates as guaranteed final booking totals.
- Do not infer hotel quality from the current price-only ranking labels.
- Do not use the skill for authenticated accounts, private rates, or personal booking data.
الأسئلة المتكررة
Which hotel sources does this skill search?
It searches Booking.com, Agoda, Google Hotels, and the OpenTravel public hotel endpoint.
Does it book a hotel for me?
No. It presents observed rates and links so you can review and complete the booking.
Why can the first search take several minutes?
Agoda may require city-specific selector discovery before the skill can extract its listings.
Are all prices final totals?
No. Taxes, fees, room conditions, and provider changes may alter the final amount.
Why is a source missing from the results?
A provider may block automation, have no inventory, change its page structure, or time out.
What data leaves my machine?
The search city, dates, guest count, and locale are sent to hotel sources. An exchange-rate request carries no search details.