Fähigkeiten pricewin-booking-assistant

📦

pricewin-booking-assistant

Name: pricewin-booking-assistant
Author: PriceWin

v1.0.3 Inhaltsrevision r1 Hohes Risiko 📁 Dateisystemzugriff⚙️ Externe Befehle🌐 Netzwerkzugriff

Book and Manage Hotel Stays

Comparing rooms and completing a booking across providers requires several careful steps. This skill guides discovery, confirmation, payment links, status checks, and cancellation.

Unterstützt: Claude Codex Code(CC)

⚠️ 38 Schlecht

Maintain this Skill? Claim it ⚠️ 38 Schlecht

Vor der Installation anhalten und eine Bestätigung anfordern.

Prüfen Sie den Plan und holen Sie vor Änderungen an Dateien die ausdrückliche Zustimmung des Benutzers ein.

Mit meinem Agent installieren

Kopieren Sie diese Anfrage in Ihren Agent. Sie enthält die maßgebliche Skill-Seite und das Manifest.

Agent-Anfrage

Review the Skillstore skill "pricewin-booking-assistant" from https://skillstore.io/skills/price-win-pricewin-booking-assistant.md and its manifest at https://skillstore.io/api/skills/price-win-pricewin-booking-assistant/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Ihr Agent sollte weiterhin seinen Plan anzeigen und alle von der Sicherheitsrichtlinie verlangten Bestätigungen anfordern.

Agent-lesbare Ressourcen

Verwenden Sie diese Links, wenn ein KI-Agent, Crawler oder Skript sauberen Kontext benötigt, statt die vollständige Seite zu lesen.

Markdown-Detailseite GET /skills/price-win-pricewin-booking-assistant.md Signiertes manifest GET /api/skills/price-win-pricewin-booking-assistant/manifest Signiertes lockfile GET /api/skills/price-win-pricewin-booking-assistant/lockfile

Testen

„pricewin-booking-assistant“ wird verwendet. Find a well-reviewed hotel in Da Nang for two adults within 120 USD per night.

Erwartetes Ergebnis:

Seaside Central Hotel, rated 8.7 from 1,240 reviews. Deluxe Double costs 108 USD nightly. Free cancellation applies until the displayed deadline.

„pricewin-booking-assistant“ wird verwendet. Book the selected room using PayPal.

Erwartetes Ergebnis:

Please confirm the hotel, room, dates, two guests, full total, guest name, email, phone number, and PayPal before I create the reservation.

„pricewin-booking-assistant“ wird verwendet. My payment link expired for confirmation code K7X9M2P4.

Erwartetes Ergebnis:

I will renew the payment link for the existing reservation. The confirmation code remains K7X9M2P4, so no duplicate booking is created.

Sicherheitsaudit

Hohes Risiko

v1 • 16.8.2026 Versionsbericht öffnen

The apparent shell execution and path traversal findings are Markdown formatting and relative documentation links, not executable behavior. The material risks are real booking authority and transmission of guest PII and verbatim requests to PriceWin's closed-source hosted service.

Gescannte Dateien

363

Analysierte Zeilen

Prüfelemente

Falschmeldungen ignoriert

Bestätigte Sicherheitsbedenken (2)

Hoch

SKILL.md:89-102

Real-World Booking Authority

The skill creates real hotel reservations and payment links after conversational confirmation. Mistaken or manipulated invocation can create financial and contractual consequences.

The documented flow explicitly gathers booking inputs, requests confirmation, and then calls create_booking to return a live payment link.

Hoch

SECURITY.md:37-46 SECURITY.md:19-23

PII and Verbatim Request Sent to Closed Backend

The booking flow sends guest name, phone, email, and the user's original request to PriceWin. Verbatim requests may contain unrelated sensitive information.

The security document lists each transmitted field, states that queryText is sent verbatim, and says the hosted server is closed-source.

Elemente der Fähigkeitsprüfung (1)

Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.

Hoch

SKILL.md:142

Hardcoded URL

phone, email) to PriceWin's hosted MCP server `https://mcp.price.win/mcp` — that

The hosted MCP endpoint receives guest name, phone, email, and booking data. This intentional external transmission creates a real privacy and service-trust risk.

Risikofaktoren

Geprüft von: codex

Diesen Bericht teilen & zitieren

Teile den versionierten Bewertungsbericht, das neutrale Badge, die Einbettungskarte und Zitate. Skillstore berichtet Nachweise, ohne zu entscheiden, ob dieser Skill sicher ist.

Versionsbericht öffnen

Berichtslink kopieren

https://skillstore.io/skills/price-win-pricewin-booking-assistant/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown-Badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/price-win-pricewin-booking-assistant/security.svg)](https://skillstore.io/skills/price-win-pricewin-booking-assistant?utm_source=security_passport_badge)

HTML-Badge

<a href="https://skillstore.io/skills/price-win-pricewin-booking-assistant?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/price-win-pricewin-booking-assistant/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Einbettungskarte

<iframe src="https://skillstore.io/embed/skills/price-win-pricewin-booking-assistant.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Wissenschaftliche Zitate (APA · BibTeX · CFF)

APA-Zitat

PriceWin. (2026). pricewin-booking-assistant security audit report (audit version 1) [Author version 1.0.3]. Skillstore. https://skillstore.io/skills/price-win-pricewin-booking-assistant/audits/1

BibTeX-Zitat

@techreport{pricewin-price-win-pricewin-booking-assistant-2026,
  author = {PriceWin},
  title = {pricewin-booking-assistant security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/price-win-pricewin-booking-assistant/audits/1},
  note = {Author version 1.0.3}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "pricewin-booking-assistant security audit report (audit version 1)"
version: "1.0.3"
type: report
authors:
  - name: "PriceWin"
date-released: "2026-08-16"
url: "https://skillstore.io/skills/price-win-pricewin-booking-assistant/audits/1"
identifiers:
  - type: other
    value: "skillstore:price-win-pricewin-booking-assistant:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore-Score

Warum dieser Score Evidenzvertrauen: Mittel

Architektur

100

Wartbarkeit

Inhalt

Gemeinschaft

Spezifikationskonformität

Was Sie erstellen können

Reserve a Personal Stay

Compare suitable rooms, review the full total, and create a confirmed reservation with a chosen payment method.

Coordinate Business Travel

Shortlist credible hotels and collect guest details before an authorized employee confirms the booking.

Manage an Existing Reservation

Check payment status, replace an expired payment link, or complete a guest-authorized cancellation.

Diese Prompts ausprobieren

Find a Hotel

Find hotels in [city] from [check-in] to [check-out] for [guest count]. Show three strong options within [budget].

Compare Rooms

Compare available rooms at [hotel] for my dates. Include total price, capacity, rating, review count, and cancellation terms.

Create a Booking

Book the selected OpenTravel room. Ask for all required guest details, show the complete summary, and wait for my explicit confirmation.

Recover or Cancel a Booking

For confirmation code [code], check status first. Renew the payment link if expired, or begin token-protected cancellation when requested.

Bewährte Praktiken

Verify current room details and total price immediately before requesting confirmation.
Collect only required guest data and ensure the guest types the email address.
Keep the confirmation code and renew expired links instead of creating another booking.

Vermeiden

Do not create a booking before the user confirms every detail and the full total.
Do not ask for card numbers, CVV values, bank credentials, or PayPal passwords.
Do not present OTA inventory as booked or construct provider URLs manually.

Häufig gestellte Fragen

Which hotels can this skill book directly?

Only OpenTravel direct properties with a property ID and room type ID can be booked through this skill.

Can it book Booking.com, Agoda, or Traveloka rooms?

No. It can show returned provider links, but the user completes those reservations on the provider site.

Does the skill handle card or bank credentials?

No. It returns a hosted payment link, and the user enters payment credentials on the provider page.

What personal data is transmitted?

PriceWin receives the guest name, phone, email, booking details, payment-method choice, and original request text.

What happens when a payment link expires?

The skill renews the link for the existing confirmation code. It must not create a second reservation.

How does cancellation work?

The guest receives a single-use cancellation token by email and must provide it before cancellation can complete.

Entwicklerdetails

Autor

PriceWin

Lizenz

MIT

Autorenversion

v1.0.3

Skillstore-Revision

Repository

https://github.com/price-win/pricewin-skills-hub/tree/ea022aa512aaf729d9d91ff4f4a0b9a965f6a521/skills/pricewin-booking-assistant

Ref.

45f3d263aa9101b39f66ea71fda13853f0aab6e5

Aktualität der Wartung

16.8.2026

Nutzung

0 Downloads · 0 Aufrufe

Dateistruktur

📄 reference.md

📄 SECURITY.md

📄 skill-card.md

📄 SKILL.md