Habilidades pricewin-booking-assistant

📦

pricewin-booking-assistant

Name: pricewin-booking-assistant
Author: PriceWin

v1.0.3 Revisión del contenido r1 Riesgo alto 📁 Acceso al sistema de archivos⚙️ Comandos externos🌐 Acceso a red

Book and Manage Hotel Stays

Comparing rooms and completing a booking across providers requires several careful steps. This skill guides discovery, confirmation, payment links, status checks, and cancellation.

Compatible con: Claude Codex Code(CC)

⚠️ 38 Deficiente

Detente y solicita confirmación antes de instalar.

Revisa el plan y obtén el consentimiento explícito del usuario antes de modificar archivos.

Instalar con mi Agente

Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.

Solicitud de agente

Review the Skillstore skill "pricewin-booking-assistant" from https://skillstore.io/skills/price-win-pricewin-booking-assistant.md and its manifest at https://skillstore.io/api/skills/price-win-pricewin-booking-assistant/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.

Recursos legibles por agentes

Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.

Detalle Markdown GET /skills/price-win-pricewin-booking-assistant.md Manifest firmado GET /api/skills/price-win-pricewin-booking-assistant/manifest Lockfile firmado GET /api/skills/price-win-pricewin-booking-assistant/lockfile

Pruébalo

Usando "pricewin-booking-assistant". Find a well-reviewed hotel in Da Nang for two adults within 120 USD per night.

Resultado esperado:

Seaside Central Hotel, rated 8.7 from 1,240 reviews. Deluxe Double costs 108 USD nightly. Free cancellation applies until the displayed deadline.

Usando "pricewin-booking-assistant". Book the selected room using PayPal.

Resultado esperado:

Please confirm the hotel, room, dates, two guests, full total, guest name, email, phone number, and PayPal before I create the reservation.

Usando "pricewin-booking-assistant". My payment link expired for confirmation code K7X9M2P4.

Resultado esperado:

I will renew the payment link for the existing reservation. The confirmation code remains K7X9M2P4, so no duplicate booking is created.

Auditoría de seguridad

Riesgo alto

v1 • 16/8/2026 Abrir el informe versionado

The apparent shell execution and path traversal findings are Markdown formatting and relative documentation links, not executable behavior. The material risks are real booking authority and transmission of guest PII and verbatim requests to PriceWin's closed-source hosted service.

Archivos escaneados

363

Líneas analizadas

Elementos de revisión

Falsos positivos ignorados

Preocupaciones de seguridad confirmadas (2)

Alto

SKILL.md:89-102

Real-World Booking Authority

The skill creates real hotel reservations and payment links after conversational confirmation. Mistaken or manipulated invocation can create financial and contractual consequences.

The documented flow explicitly gathers booking inputs, requests confirmation, and then calls create_booking to return a live payment link.

Alto

SECURITY.md:37-46 SECURITY.md:19-23

PII and Verbatim Request Sent to Closed Backend

The booking flow sends guest name, phone, email, and the user's original request to PriceWin. Verbatim requests may contain unrelated sensitive information.

The security document lists each transmitted field, states that queryText is sent verbatim, and says the hosted server is closed-source.

Elementos de revisión de capacidades (1)

Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.

Alto

SKILL.md:142

Hardcoded URL

phone, email) to PriceWin's hosted MCP server `https://mcp.price.win/mcp` — that

The hosted MCP endpoint receives guest name, phone, email, and booking data. This intentional external transmission creates a real privacy and service-trust risk.

Factores de riesgo

📁 Acceso al sistema de archivos (3)

SECURITY.md:28 SECURITY.md:29 SKILL.md:48

⚙️ Comandos externos (42)

🌐 Acceso a red (2)

SKILL.md:11 SKILL.md:142

Auditado por: codex

Compartir y citar este informe

Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.

Abrir el informe versionado

Copiar enlace del informe

https://skillstore.io/skills/price-win-pricewin-booking-assistant/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Insignia Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/price-win-pricewin-booking-assistant/security.svg)](https://skillstore.io/skills/price-win-pricewin-booking-assistant?utm_source=security_passport_badge)

Insignia HTML

<a href="https://skillstore.io/skills/price-win-pricewin-booking-assistant?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/price-win-pricewin-booking-assistant/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Tarjeta para insertar

<iframe src="https://skillstore.io/embed/skills/price-win-pricewin-booking-assistant.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citas académicas (APA · BibTeX · CFF)

Cita APA

PriceWin. (2026). pricewin-booking-assistant security audit report (audit version 1) [Author version 1.0.3]. Skillstore. https://skillstore.io/skills/price-win-pricewin-booking-assistant/audits/1

Cita BibTeX

@techreport{pricewin-price-win-pricewin-booking-assistant-2026,
  author = {PriceWin},
  title = {pricewin-booking-assistant security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/price-win-pricewin-booking-assistant/audits/1},
  note = {Author version 1.0.3}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "pricewin-booking-assistant security audit report (audit version 1)"
version: "1.0.3"
type: report
authors:
  - name: "PriceWin"
date-released: "2026-08-16"
url: "https://skillstore.io/skills/price-win-pricewin-booking-assistant/audits/1"
identifiers:
  - type: other
    value: "skillstore:price-win-pricewin-booking-assistant:audit:1"
    description: "Skillstore immutable audit report identifier"

Puntuación de Skillstore

Por qué esta puntuación Confianza de la evidencia: Medio

Arquitectura

100

Mantenibilidad

Contenido

Comunidad

Cumplimiento de la especificación

Lo que puedes crear

Reserve a Personal Stay

Compare suitable rooms, review the full total, and create a confirmed reservation with a chosen payment method.

Coordinate Business Travel

Shortlist credible hotels and collect guest details before an authorized employee confirms the booking.

Manage an Existing Reservation

Check payment status, replace an expired payment link, or complete a guest-authorized cancellation.

Prueba estos prompts

Find a Hotel

Find hotels in [city] from [check-in] to [check-out] for [guest count]. Show three strong options within [budget].

Compare Rooms

Compare available rooms at [hotel] for my dates. Include total price, capacity, rating, review count, and cancellation terms.

Create a Booking

Book the selected OpenTravel room. Ask for all required guest details, show the complete summary, and wait for my explicit confirmation.

Recover or Cancel a Booking

For confirmation code [code], check status first. Renew the payment link if expired, or begin token-protected cancellation when requested.

Mejores prácticas

Verify current room details and total price immediately before requesting confirmation.
Collect only required guest data and ensure the guest types the email address.
Keep the confirmation code and renew expired links instead of creating another booking.

Evitar

Do not create a booking before the user confirms every detail and the full total.
Do not ask for card numbers, CVV values, bank credentials, or PayPal passwords.
Do not present OTA inventory as booked or construct provider URLs manually.

Preguntas frecuentes

Which hotels can this skill book directly?

Only OpenTravel direct properties with a property ID and room type ID can be booked through this skill.

Can it book Booking.com, Agoda, or Traveloka rooms?

No. It can show returned provider links, but the user completes those reservations on the provider site.

Does the skill handle card or bank credentials?

No. It returns a hosted payment link, and the user enters payment credentials on the provider page.

What personal data is transmitted?

PriceWin receives the guest name, phone, email, booking details, payment-method choice, and original request text.

What happens when a payment link expires?

The skill renews the link for the existing confirmation code. It must not create a second reservation.

How does cancellation work?

The guest receives a single-use cancellation token by email and must provide it before cancellation can complete.

Detalles del desarrollador

Autor

PriceWin

Licencia

MIT

Versión del autor

v1.0.3

Revisión de Skillstore

Repositorio

https://github.com/price-win/pricewin-skills-hub/tree/ea022aa512aaf729d9d91ff4f4a0b9a965f6a521/skills/pricewin-booking-assistant

Ref.

45f3d263aa9101b39f66ea71fda13853f0aab6e5

Actualidad del mantenimiento

16/8/2026

Uso

0 descargas · 0 vistas

Estructura de archivos

📄 reference.md

📄 SECURITY.md

📄 skill-card.md

📄 SKILL.md