Fähigkeiten pricewin-hotel-deal-finder
📦
pricewin-hotel-deal-finder
v1.1.3 Inhaltsrevision r1 Hohes Risiko ⚡ Enthält Skripte⚙️ Externe Befehle🌐 Netzwerkzugriff📁 Dateisystemzugriff🔑 Umgebungsvariablen
Compare Live Hotel Prices Across Major Sources
Checking several hotel sites takes time and produces inconsistent currencies. This skill searches four sources and presents comparable nightly rates with booking links.
Unterstützt: Claude Codex Code(CC)
Vor der Installation anhalten und eine Bestätigung anfordern.
Prüfen Sie den Plan und holen Sie vor Änderungen an Dateien die ausdrückliche Zustimmung des Benutzers ein.
Mit meinem Agent installieren
Kopieren Sie diese Anfrage in Ihren Agent. Sie enthält die maßgebliche Skill-Seite und das Manifest.
Agent-Anfrage
Review the Skillstore skill "pricewin-hotel-deal-finder" from https://skillstore.io/skills/price-win-pricewin-hotel-deal-finder.md and its manifest at https://skillstore.io/api/skills/price-win-pricewin-hotel-deal-finder/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Ihr Agent sollte weiterhin seinen Plan anzeigen und alle von der Sicherheitsrichtlinie verlangten Bestätigungen anfordern.
Agent-lesbare Ressourcen
Verwenden Sie diese Links, wenn ein KI-Agent, Crawler oder Skript sauberen Kontext benötigt, statt die vollständige Seite zu lesen.
Testen
„pricewin-hotel-deal-finder“ wird verwendet. Find Tokyo hotels for August 12 to 15 for two adults.
Erwartetes Ergebnis:
A ranked hotel list with nightly USD prices, compared sources, savings differences, and direct booking links.
„pricewin-hotel-deal-finder“ wird verwendet. Compare Bangkok hotel rates below 100 USD per night.
Erwartetes Ergebnis:
Available lower-priced options grouped by source, plus a clear note when one provider returns no inventory.
„pricewin-hotel-deal-finder“ wird verwendet. Check Booking.com and Agoda prices for a three-night stay in Paris.
Erwartetes Ergebnis:
A ranked list of observed rates from available sources, with links for hotels that returned booking URLs.
Sicherheitsaudit
Hohes Risikov1 • 16.8.2026 Versionsbericht öffnen
Static alerts were false positives caused by template literals, fixed local spawns, expected network and cache activity, loopback services, documentation, and lockfile integrity hashes. Semantic review found high-risk anti-bot evasion and automatic sandbox removal under Linux root. It also found unsafe URL scheme validation, raw snapshot exposure, unsupported ranking labels, and incomplete currency conversion.
12
Gescannte Dateien
2,542
Analysierte Zeilen
0
Prüfelemente
0
Falschmeldungen ignoriert
Bestätigte Sicherheitsbedenken (6)
Hoch
Stealth Automation Evades OTA Bot Detection
The skill deliberately masks browser automation and directs agents to use the stealth path because normal browser automation is detected. This bypasses provider anti-bot controls and may violate access policies.
Both files explicitly describe fingerprint masking, avoiding bot detection, and using Patchright because standard automation is blocked.
Hoch
Chromium Sandbox Automatically Disabled for Linux Root
The daemon adds --no-sandbox whenever it runs as root on Linux. A compromised or malicious hotel page would then execute without Chromium sandbox isolation in a privileged process.
The root check directly adds --no-sandbox before launching Chromium, and the daemon loads remote OTA pages.
Mittel
URL Scheme Allowlist Uses an Unsafe Prefix Check
cleanLink claims to allow only HTTP and HTTPS, but startsWith("http") also accepts custom schemes such as httpx. Untrusted provider links can reach formatted output without an exact protocol check.
The implementation checks a string prefix before URL parsing and never verifies that protocol is exactly http: or https:.
Mittel
Raw Browser Snapshots Can Expose Indirect Prompt Injection
The snapshot command serializes page text and attributes and prints them for agent use without sanitizeText. A hostile page can place model-directed instructions in this output if the command is used directly.
The snapshot path returns arbitrary visible page text to stdout; the one-shot search avoids exposing it, but the public CLI command remains available.
Mittel
Quality and Value Labels Are Based Only on Price
Hotels are sorted only by minimum observed price, then the first three are labeled BEST VALUE, CHEAPEST, and QUALITY. The documented output has no rating or area data to support quality claims.
The ranking expression uses only prices, while the documentation explicitly states that star ratings and area data are unavailable.
Mittel
Non-USD and Non-VND Prices Are Misclassified as USD
The extractor recognizes EUR, GBP, THB, and JPY, but toUSD converts only VND and treats every other currency amount as USD. Localized searches can produce materially incorrect comparisons.
The detected currency enum includes five non-USD currencies, while conversion logic has only a VND branch and an assume-USD fallback.
Risikofaktoren
⚡ Enthält Skripte (3)
⚙️ Externe Befehle (50)
bin/browse.js:16 bin/browse.js:98 bin/browse.js:6 bin/browse.js:11 bin/browse.js:52 bin/browse.js:63 bin/browse.js:74 bin/browse.js:75 bin/browse.js:82 bin/browse.js:126 bin/browse.js:162 bin/browse.js:171 bin/browse.js:182 bin/browse.js:183 bin/browse.js:192 bin/browse.js:202 bin/browse.js:204 bin/browse.js:206 bin/browse.js:213 bin/browse.js:229 bin/browse.js:351 bin/browse.js:377 bin/browse.js:387 bin/browse.js:409 bin/browse.js:477 bin/daemon.js:8 bin/daemon.js:9 bin/daemon.js:14 bin/daemon.js:17 bin/daemon.js:79 bin/daemon.js:90 bin/daemon.js:105 bin/daemon.js:156 bin/daemon.js:176 bin/daemon.js:192 bin/daemon.js:244 bin/daemon.js:275 bin/daemon.js:296 bin/daemon.js:315 bin/daemon.js:317 bin/daemon.js:395 bin/daemon.js:477 bin/daemon.js:520 bin/daemon.js:539 bin/daemon.js:562 bin/daemon.js:576 bin/daemon.js:591 bin/search.js:12 bin/search.js:28 bin/search.js:32
🌐 Netzwerkzugriff (38)
bin/browse.js:63 bin/browse.js:75 bin/browse.js:347 bin/browse.js:373 bin/browse.js:320 bin/browse.js:322 bin/browse.js:37 bin/browse.js:63 bin/browse.js:75 bin/browse.js:63 bin/browse.js:75 bin/daemon.js:473 bin/daemon.js:211 bin/daemon.js:53 bin/daemon.js:223 bin/daemon.js:53 bin/daemon.js:54 bin/daemon.js:59 bin/daemon.js:199 bin/daemon.js:212 bin/daemon.js:574 bin/search.js:78 bin/search.js:78 bin/search.js:107 bin/search.js:108 bin/search.js:355 bin/search.js:437 bin/search.js:484 package-lock.json:23 package-lock.json:37 package-lock.json:55 package.json:9 package.json:12 package.json:15 SKILL.md:15 SKILL.md:17 SKILL.md:60 SKILL.md:110
📁 Dateisystemzugriff (44)
bin/browse.js:397 bin/browse.js:24 bin/browse.js:33 bin/browse.js:113 bin/browse.js:113 bin/daemon.js:546 bin/daemon.js:32 bin/daemon.js:33 bin/daemon.js:34 bin/daemon.js:16 bin/daemon.js:16 bin/search.js:146 bin/search.js:160 bin/search.js:165 bin/search.js:172 bin/search.js:175 bin/search.js:200 bin/search.js:217 bin/search.js:469 install.sh:24 install.sh:24 lib/browser-state.js:42 lib/browser-state.js:45 lib/browser-state.js:50 lib/browser-state.js:59 lib/browser-state.js:8 lib/browser-state.js:8 lib/dom-extract.js:54 lib/dom-extract.js:55 lib/dom-extract.js:56 lib/dom-extract.js:57 lib/dom-extract.js:58 lib/selector-cache.js:55 lib/selector-cache.js:63 lib/selector-cache.js:15 lib/selector-cache.js:15 lib/snapshot.js:65 lib/snapshot.js:71 SECURITY.md:41 SECURITY.md:76 SECURITY.md:41 SECURITY.md:76 SKILL.md:73 SKILL.md:73
Geprüft von: codex
Diesen Bericht teilen & zitieren
Teile den versionierten Bewertungsbericht, das neutrale Badge, die Einbettungskarte und Zitate. Skillstore berichtet Nachweise, ohne zu entscheiden, ob dieser Skill sicher ist.
Berichtslink kopieren
https://skillstore.io/skills/price-win-pricewin-hotel-deal-finder/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown-Badge
[](https://skillstore.io/skills/price-win-pricewin-hotel-deal-finder?utm_source=security_passport_badge)HTML-Badge
<a href="https://skillstore.io/skills/price-win-pricewin-hotel-deal-finder?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/price-win-pricewin-hotel-deal-finder/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Einbettungskarte
<iframe src="https://skillstore.io/embed/skills/price-win-pricewin-hotel-deal-finder.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Wissenschaftliche Zitate (APA · BibTeX · CFF)
APA-Zitat
PriceWin. (2026). pricewin-hotel-deal-finder security audit report (audit version 1) [Author version 1.1.3]. Skillstore. https://skillstore.io/skills/price-win-pricewin-hotel-deal-finder/audits/1BibTeX-Zitat
@techreport{pricewin-price-win-pricewin-hotel-deal-finder-2026,
author = {PriceWin},
title = {pricewin-hotel-deal-finder security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/price-win-pricewin-hotel-deal-finder/audits/1},
note = {Author version 1.1.3}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "pricewin-hotel-deal-finder security audit report (audit version 1)"
version: "1.1.3"
type: report
authors:
- name: "PriceWin"
date-released: "2026-08-16"
url: "https://skillstore.io/skills/price-win-pricewin-hotel-deal-finder/audits/1"
identifiers:
- type: other
value: "skillstore:price-win-pricewin-hotel-deal-finder:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore-Score
Warum dieser Score Evidenzvertrauen: Mittel 55
Architektur
100
Wartbarkeit
85
Inhalt
65
Gemeinschaft
91
Spezifikationskonformität
Was Sie erstellen können
Plan a personal trip
Compare nightly rates across several sources before choosing a hotel.
Check a travel budget
Find lower-priced stays for fixed dates and a defined guest count.
Research accommodation options
Review source coverage and booking links for a destination shortlist.
Diese Prompts ausprobieren
Basic city search
Find hotel prices in {city} from {check_in} to {check_out} for {adults} adults.Budget comparison
Compare hotel rates in {city} for {dates}. Highlight options near {nightly_budget} per night.Source comparison
Search {city} for {dates} and compare returned hotels across Booking.com, Agoda, Google Hotels, and OpenTravel.Advanced localized search
Search {city} for {dates}, {adults} adults, and locale {locale}. Report partial sources and preserve valid booking links.Bewährte Praktiken
- Provide an exact city, check-in date, check-out date, and adult count.
- Verify taxes, cancellation terms, room type, and final totals on the booking page.
- Treat missing sources as partial coverage and retry only when current prices are essential.
Vermeiden
- Do not treat displayed rates as guaranteed final booking totals.
- Do not infer hotel quality from the current price-only ranking labels.
- Do not use the skill for authenticated accounts, private rates, or personal booking data.
Häufig gestellte Fragen
Which hotel sources does this skill search?
It searches Booking.com, Agoda, Google Hotels, and the OpenTravel public hotel endpoint.
Does it book a hotel for me?
No. It presents observed rates and links so you can review and complete the booking.
Why can the first search take several minutes?
Agoda may require city-specific selector discovery before the skill can extract its listings.
Are all prices final totals?
No. Taxes, fees, room conditions, and provider changes may alter the final amount.
Why is a source missing from the results?
A provider may block automation, have no inventory, change its page structure, or time out.
What data leaves my machine?
The search city, dates, guest count, and locale are sent to hotel sources. An exchange-rate request carries no search details.