Fähigkeiten rollinggo-searchhotel

📦

rollinggo-searchhotel

Name: rollinggo-searchhotel
Author: RollingGo-AI

Inhaltsrevision r1 Hohes Risiko 📁 Dateisystemzugriff🔑 Umgebungsvariablen⚙️ Externe Befehle🌐 Netzwerkzugriff

Hotelsuche mit RollingGo

Die Hotelsuche benötigt oft aktuelle Preise, Tags und Zimmerdetails. Diese Skill nutzt die RollingGo CLI, um Hotels zu finden und strukturierte Ergebnisse zu vergleichen.

Unterstützt: Claude Codex Code(CC)

⚠️ 38 Schlecht

Vor der Installation anhalten und eine Bestätigung anfordern.

Prüfen Sie den Plan und holen Sie vor Änderungen an Dateien die ausdrückliche Zustimmung des Benutzers ein.

Mit meinem Agent installieren

Kopieren Sie diese Anfrage in Ihren Agent. Sie enthält die maßgebliche Skill-Seite und das Manifest.

Agent-Anfrage

Review the Skillstore skill "rollinggo-searchhotel" from https://skillstore.io/skills/rollinggo-ai-rollinggo-searchhotel.md and its manifest at https://skillstore.io/api/skills/rollinggo-ai-rollinggo-searchhotel/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Ihr Agent sollte weiterhin seinen Plan anzeigen und alle von der Sicherheitsrichtlinie verlangten Bestätigungen anfordern.

Agent-lesbare Ressourcen

Verwenden Sie diese Links, wenn ein KI-Agent, Crawler oder Skript sauberen Kontext benötigt, statt die vollständige Seite zu lesen.

Markdown-Detailseite GET /skills/rollinggo-ai-rollinggo-searchhotel.md Signiertes manifest GET /api/skills/rollinggo-ai-rollinggo-searchhotel/manifest Signiertes lockfile GET /api/skills/rollinggo-ai-rollinggo-searchhotel/lockfile

Testen

„rollinggo-searchhotel“ wird verwendet. Finde Hotels in der Nähe von Tokyo Disney für zwei Erwachsene Anfang April.

Erwartetes Ergebnis:

Eine priorisierte Shortlist mit Hotelnamen, Preisen pro Nacht, Sternebewertungen, Entfernung und verfügbaren Buchungslinks.

„rollinggo-searchhotel“ wird verwendet. Vergleiche Details für ausgewählte Hotel-IDs.

Erwartetes Ergebnis:

Ein knapper Vergleich von Zimmertypen, Gesamtpreisen für den Aufenthalt, Erstattungsbedingungen und Gründen für die Wahl jeder Option.

„rollinggo-searchhotel“ wird verwendet. Finde familienfreundliche Hotels mit Frühstück in der Nähe von Shanghai Disney.

Erwartetes Ergebnis:

Eine gefilterte Liste mit gültigen RollingGo-Tags, mit Hinweisen zur Budgeteignung und Entfernung vom Reiseziel.

Sicherheitsaudit

Hohes Risiko

v4 • 5.7.2026 Versionsbericht öffnen

The skill is not overtly malicious and I found no prompt injection attempt. It does handle a RollingGo API key and directs users to run mutable third-party CLI packages, so the main risks are credential exposure and supply-chain drift.

Gescannte Dateien

584

Analysierte Zeilen

Prüfelemente

Falschmeldungen ignoriert

Bestätigte Sicherheitsbedenken (5)

Hoch

references/claw-host-env.md:31

Environment file access

或写入宿主的 `.env` 文件:`~/.openclaw/.env`(macOS/Linux)/ `%USERPROFILE%\.openclaw\.env`(Windows)。

The documentation recommends storing or injecting the API key in host or sandbox configuration. This can persist secrets and broaden exposure if the configuration is shared.

Hoch

references/claw-host-env.md:44

Environment file access

宿主 env 配置**不会**自动传入 sandbox 进程。需在 sandbox 内直接注入 `RollingGo_API_KEY`:`agents.defaults.sandbox.docker.

The documentation recommends storing or injecting the API key in host or sandbox configuration. This can persist secrets and broaden exposure if the configuration is shared.

Hoch

SKILL.md:55-63 references/rollinggo-npx.md:53-63 references/rollinggo-uv.md:52-64

Mutable Latest Package Execution

The skill instructs agents to run rollinggo@latest through npx or uvx and to upgrade installed tools before use. A future package release could change executed code without marketplace review.

The instructions explicitly prefer @latest and refresh or upgrade behavior in multiple files. This is a clear supply-chain risk even though it supports freshness.

Mittel

references/rollinggo-npx.md:78-79 references/rollinggo-npx.md:143-145 references/rollinggo-uv.md:79-80 references/rollinggo-uv.md:145-146

API Key In Command-Line Arguments

The reference docs show using --api-key with placeholder secrets. Real API keys passed this way may be exposed through shell history, process listings, or logs.

The documentation repeatedly presents --api-key usage. The values are placeholders, but the recommended pattern creates a common secret exposure channel.

Mittel

references/claw-host-env.md:25-32 references/claw-host-env.md:42-44

Broad Host Secret Injection Guidance

The host environment reference allows API key injection at host and sandbox configuration levels. Shared scopes can expose the same credential to more skills or containers than needed.

The file directly documents host-level and sandbox-level environment injection. The risk depends on host configuration, but the broad-scope guidance is explicit.

Elemente der Fähigkeitsprüfung (32)

Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.

Hoch

references/claw-host-env.md:31

Hidden file in home directory

或写入宿主的 `.env` 文件:`~/.openclaw/.env`(macOS/Linux)/ `%USERPROFILE%\.openclaw\.env`(Windows)。

The documentation recommends storing or injecting the API key in host or sandbox configuration. This can persist secrets and broaden exposure if the configuration is shared.

Hoch

references/claw-host-env.md:3

Generic API/secret keys

本技能需要在进程里能读到 `RollingGo_API_KEY`。如果宿主在不同 run 间丢失该变量,请使用宿主级注入而非 shell export。

The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.

Hoch

references/claw-host-env.md:18

Generic API/secret keys

"env": { "RollingGo_API_KEY": "YOUR_KEY" }

The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.

Hoch

references/claw-host-env.md:28

Generic API/secret keys

{ "env": { "RollingGo_API_KEY": "YOUR_KEY" } }

The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.

Hoch

references/claw-host-env.md:44

Generic API/secret keys

宿主 env 配置**不会**自动传入 sandbox 进程。需在 sandbox 内直接注入 `RollingGo_API_KEY`:`agents.defaults.sandbox.docker.

The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.

Hoch

references/rollinggo-npx.md:69

Generic API/secret keys

解析顺序:`--api-key` 参数 → `RollingGo_API_KEY` 环境变量。

The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.

Hoch

references/rollinggo-npx.md:73

Generic API/secret keys

export RollingGo_API_KEY="YOUR_API_KEY"

The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.

Hoch

references/rollinggo-npx.md:76

Generic API/secret keys

$env:RollingGo_API_KEY="YOUR_API_KEY"

The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.

Hoch

references/rollinggo-npx.md:79

Generic API/secret keys

rollinggo hotel-tags --api-key YOUR_API_KEY

This line documents passing an API key on the command line, which can expose secrets through shell history or process listings. The example uses placeholders, but the usage pattern is real.

Hoch

references/rollinggo-npx.md:82

Generic API/secret keys

宿主经常丢失 `RollingGo_API_KEY` 时,见 [claw-host-env.md](claw-host-env.md)。

The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.

Hoch

references/rollinggo-npx.md:145

Generic API/secret keys

rollinggo hotel-tags --api-key YOUR_API_KEY

This line documents passing an API key on the command line, which can expose secrets through shell history or process listings. The example uses placeholders, but the usage pattern is real.

Hoch

references/rollinggo-npx.md:188

Generic API/secret keys

- **缺少 API Key 报错:** 传入 `--api-key`、设置 `RollingGo_API_KEY`,或者如果你跑在任何 claw 风格宿主里,就按 [claw-host-env.md

The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.

Hoch

references/rollinggo-uv.md:70

Generic API/secret keys

解析顺序:`--api-key` 参数 → `RollingGo_API_KEY` 环境变量。

The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.

Hoch

references/rollinggo-uv.md:74

Generic API/secret keys

export RollingGo_API_KEY="YOUR_API_KEY"

The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.

Hoch

references/rollinggo-uv.md:77

Generic API/secret keys

$env:RollingGo_API_KEY="YOUR_API_KEY"

The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.

Hoch

references/rollinggo-uv.md:80

Generic API/secret keys

rollinggo hotel-tags --api-key YOUR_API_KEY

This line documents passing an API key on the command line, which can expose secrets through shell history or process listings. The example uses placeholders, but the usage pattern is real.

Hoch

references/rollinggo-uv.md:83

Generic API/secret keys

宿主经常丢失 `RollingGo_API_KEY` 时,见 [claw-host-env.md](claw-host-env.md)。

The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.

Hoch

references/rollinggo-uv.md:146

Generic API/secret keys

rollinggo hotel-tags --api-key YOUR_API_KEY

This line documents passing an API key on the command line, which can expose secrets through shell history or process listings. The example uses placeholders, but the usage pattern is real.

Hoch

references/rollinggo-uv.md:192

Generic API/secret keys

- **缺少 API Key 报错:** 传入 `--api-key`、设置 `RollingGo_API_KEY`,或者如果你跑在任何 claw 风格宿主里,就按 [claw-host-env.md

The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.

Hoch

SKILL.md:10

Generic API/secret keys

"primaryEnv": "RollingGo_API_KEY",

The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.

Hoch

SKILL.md:13

Generic API/secret keys

"env": ["RollingGo_API_KEY"]

The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.

Hoch

SKILL.md:45

Generic API/secret keys

解析顺序:`--api-key` 参数 → `RollingGo_API_KEY` 环境变量。

The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.

Mittel

references/claw-host-env.md:31

Hidden file access

或写入宿主的 `.env` 文件:`~/.openclaw/.env`(macOS/Linux)/ `%USERPROFILE%\.openclaw\.env`(Windows)。

The documentation recommends storing or injecting the API key in host or sandbox configuration. This can persist secrets and broaden exposure if the configuration is shared.

Mittel

SKILL.md:57

Ruby/shell backtick execution

- **npm/npx:** `npx --yes --package rollinggo@latest rollinggo ...`

This instruction causes the agent or user to run RollingGo through npm, uv, or the installed CLI. Running third-party CLI code is intended, but it is a real external command execution path.

Mittel

SKILL.md:58

Ruby/shell backtick execution

- **uvx:** `uvx --refresh --from rollinggo@latest rollinggo ...`

This instruction causes the agent or user to run RollingGo through npm, uv, or the installed CLI. Running third-party CLI code is intended, but it is a real external command execution path.

Mittel

SKILL.md:62

Ruby/shell backtick execution

- **npm 全局:** `npm install -g rollinggo@latest`

This instruction causes the agent or user to run RollingGo through npm, uv, or the installed CLI. Running third-party CLI code is intended, but it is a real external command execution path.

Mittel

SKILL.md:63

Ruby/shell backtick execution

- **uv 工具:** `uv tool upgrade rollinggo@latest`

This instruction causes the agent or user to run RollingGo through npm, uv, or the installed CLI. Running third-party CLI code is intended, but it is a real external command execution path.

Mittel

SKILL.md:70

Ruby/shell backtick execution

2. 如果需要标签筛选 → 先执行 `hotel-tags` 获取有效标签字符串

This instruction causes the agent or user to run RollingGo through npm, uv, or the installed CLI. Running third-party CLI code is intended, but it is a real external command execution path.

Mittel

SKILL.md:71

Ruby/shell backtick execution

3. 执行 `search-hotels` → 解析 JSON → 提取 `hotelId`

This instruction causes the agent or user to run RollingGo through npm, uv, or the installed CLI. Running third-party CLI code is intended, but it is a real external command execution path.

Mittel

SKILL.md:72

Ruby/shell backtick execution

4. 执行 `hotel-detail --hotel-id <id>` 查询房型和价格

This instruction causes the agent or user to run RollingGo through npm, uv, or the installed CLI. Running third-party CLI code is intended, but it is a real external command execution path.

Mittel

SKILL.md:77-97

Ruby/shell backtick execution

```bash

This instruction causes the agent or user to run RollingGo through npm, uv, or the installed CLI. Running third-party CLI code is intended, but it is a real external command execution path.

Mittel

SKILL.md:101

Ruby/shell backtick execution

- `--place-type` 必须使用 `rollinggo search-hotels --help` 里显示的精确值

This instruction causes the agent or user to run RollingGo through npm, uv, or the installed CLI. Running third-party CLI code is intended, but it is a real external command execution path.

Risikofaktoren

📁 Dateisystemzugriff (2)

references/claw-host-env.md:31 references/claw-host-env.md:31

🔑 Umgebungsvariablen (21)

⚙️ Externe Befehle (21)

🌐 Netzwerkzugriff (2)

SKILL.md:4 SKILL.md:47

Geprüft von: codex Audit-Verlauf anzeigen →

Diesen Bericht teilen & zitieren

Teile den versionierten Bewertungsbericht, das neutrale Badge, die Einbettungskarte und Zitate. Skillstore berichtet Nachweise, ohne zu entscheiden, ob dieser Skill sicher ist.

Versionsbericht öffnen

Berichtslink kopieren

https://skillstore.io/skills/rollinggo-ai-rollinggo-searchhotel/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown-Badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/rollinggo-ai-rollinggo-searchhotel/security.svg)](https://skillstore.io/skills/rollinggo-ai-rollinggo-searchhotel?utm_source=security_passport_badge)

HTML-Badge

<a href="https://skillstore.io/skills/rollinggo-ai-rollinggo-searchhotel?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/rollinggo-ai-rollinggo-searchhotel/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Einbettungskarte

<iframe src="https://skillstore.io/embed/skills/rollinggo-ai-rollinggo-searchhotel.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Wissenschaftliche Zitate (APA · BibTeX · CFF)

APA-Zitat

RollingGo-AI. (2026). rollinggo-searchhotel security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/rollinggo-ai-rollinggo-searchhotel/audits/4

BibTeX-Zitat

@techreport{rollinggo-ai-rollinggo-ai-rollinggo-searchhotel-2026,
  author = {RollingGo-AI},
  title = {rollinggo-searchhotel security audit report (audit version 4)},
  institution = {Skillstore},
  year = {2026},
  number = {4},
  url = {https://skillstore.io/skills/rollinggo-ai-rollinggo-searchhotel/audits/4},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "rollinggo-searchhotel security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
  - name: "RollingGo-AI"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/rollinggo-ai-rollinggo-searchhotel/audits/4"
identifiers:
  - type: other
    value: "skillstore:rollinggo-ai-rollinggo-searchhotel:audit:4"
    description: "Skillstore immutable audit report identifier"

Skillstore-Score

Warum dieser Score Evidenzvertrauen: Mittel

Architektur

Wartbarkeit

Inhalt

Gemeinschaft

Spezifikationskonformität

Was Sie erstellen können

Familienhotels in der Nähe von Attraktionen finden

Hotels in der Nähe einer Sehenswürdigkeit mit Daten, Gästezahlen, Budget und familienfreundlichen Tags suchen.

Zimmerpreise vor der Buchung vergleichen

Hotelinformationen und Zimmerpreise für ausgewählte Hotel-IDs abrufen, bevor Buchungslinks geteilt werden.

Gefilterte Hotel-Shortlists erstellen

Tags, Marken, Entfernung und Sternebewertungen verwenden, um eine fokussierte Shortlist für eine Reise zu erstellen.

Diese Prompts ausprobieren

Einfache Hotelsuche

Suche Hotels in der Nähe des Tokyo Disney Resort für zwei Erwachsene vom 1. April bis 3. April 2026. Zeige fünf gute Optionen.

Budget- und Sternefilter

Finde Hotels in der Nähe von Shanghai Disney für zwei Nächte unter 800 CNY pro Nacht. Beschränke die Ergebnisse auf Vier- und Fünf-Sterne-Hotels.

Tag-basierte Familiensuche

Rufe die verfügbaren Hotel-Tags ab und suche dann Hotels bei Tokyo Disney, die familienfreundlich sind und Frühstück beinhalten.

Detaillierter Hotelvergleich

Suche drei Hotels in der Nähe des Bund in Shanghai, prüfe die Zimmerdetails für jede Hotel-ID und vergleiche Preis, Zimmertyp und Stornierungsbedingungen.

Bewährte Praktiken

Reiseziel, Daten, Gäste, Zimmer und Budget vor der Suche bestätigen.
Hotel-IDs aus den Suchergebnissen verwenden, wenn Zimmerdetails angefordert werden.
Den RollingGo API key in einer begrenzten Secret-Konfiguration speichern.