Compétences pricewin-booking-assistant
📩

pricewin-booking-assistant

v1.0.3 RĂ©vision du contenu r1 Risque Ă©levĂ© 📁 AccĂšs au systĂšme de fichiers⚙ Commandes externes🌐 AccĂšs rĂ©seau

Book and Manage Hotel Stays

Comparing rooms and completing a booking across providers requires several careful steps. This skill guides discovery, confirmation, payment links, status checks, and cancellation.

Prend en charge: Claude Codex Code(CC)
Maintain this Skill? Claim it ⚠ 38 MĂ©diocre

Installer avec mon Agent

Copiez cette demande dans votre Agent. Elle contient la page Skill de référence et le manifeste.

Demande d’agent
Review the Skillstore skill "pricewin-booking-assistant" from https://skillstore.io/skills/price-win-pricewin-booking-assistant.md and its manifest at https://skillstore.io/api/skills/price-win-pricewin-booking-assistant/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Votre Agent doit toujours présenter son plan et demander toute confirmation exigée par la politique de sécurité.

Ressources lisibles par les agents

Utilisez ces liens lorsqu’un Agent IA, un crawler ou un script a besoin d’un contexte propre au lieu de lire toute la page.

Détail Markdown GET /skills/price-win-pricewin-booking-assistant.md manifest signé GET /api/skills/price-win-pricewin-booking-assistant/manifest lockfile signé GET /api/skills/price-win-pricewin-booking-assistant/lockfile

Tester

Utilisation de « pricewin-booking-assistant ». Find a well-reviewed hotel in Da Nang for two adults within 120 USD per night.

RĂ©sultat attendu:

Seaside Central Hotel, rated 8.7 from 1,240 reviews. Deluxe Double costs 108 USD nightly. Free cancellation applies until the displayed deadline.

Utilisation de « pricewin-booking-assistant ». Book the selected room using PayPal.

RĂ©sultat attendu:

Please confirm the hotel, room, dates, two guests, full total, guest name, email, phone number, and PayPal before I create the reservation.

Utilisation de « pricewin-booking-assistant ». My payment link expired for confirmation code K7X9M2P4.

RĂ©sultat attendu:

I will renew the payment link for the existing reservation. The confirmation code remains K7X9M2P4, so no duplicate booking is created.

Audit de sécurité

Risque élevé
v1 ‱ 16/08/2026 Ouvrir le rapport versionnĂ©

The apparent shell execution and path traversal findings are Markdown formatting and relative documentation links, not executable behavior. The material risks are real booking authority and transmission of guest PII and verbatim requests to PriceWin's closed-source hosted service.

4
Fichiers analysés
363
Lignes analysées
1
ÉlĂ©ments Ă  examiner
0
Faux positifs ignorés

Préoccupations de sécurité confirmées (2)

ÉlevĂ©
SKILL.md:89-102
Real-World Booking Authority
The skill creates real hotel reservations and payment links after conversational confirmation. Mistaken or manipulated invocation can create financial and contractual consequences.
The documented flow explicitly gathers booking inputs, requests confirmation, and then calls create_booking to return a live payment link.
ÉlevĂ©
SECURITY.md:37-46SECURITY.md:19-23
PII and Verbatim Request Sent to Closed Backend
The booking flow sends guest name, phone, email, and the user's original request to PriceWin. Verbatim requests may contain unrelated sensitive information.
The security document lists each transmitted field, states that queryText is sent verbatim, and says the hosted server is closed-source.
ÉlĂ©ments d’évaluation des capacitĂ©s (1)

Il s’agit de capacitĂ©s locales rĂ©elles qui peuvent ĂȘtre attendues pour cette compĂ©tence ; elles nĂ©cessitent donc un examen, mais ne sont pas comptabilisĂ©es comme comportement malveillant confirmĂ©.

ÉlevĂ©
SKILL.md:142
Hardcoded URL
phone, email) to PriceWin's hosted MCP server `https://mcp.price.win/mcp` — that
The hosted MCP endpoint receives guest name, phone, email, and booking data. This intentional external transmission creates a real privacy and service-trust risk.

Facteurs de risque

📁 Accùs au systùme de fichiers (3)
SECURITY.md:28 SECURITY.md:29 SKILL.md:48
⚙ Commandes externes (42)
SKILL.md:14 SKILL.md:19 SKILL.md:25 SKILL.md:26 SKILL.md:28 SKILL.md:29 SKILL.md:33 SKILL.md:34 SKILL.md:35 SKILL.md:36 SKILL.md:37 SKILL.md:39 SKILL.md:40 SKILL.md:46 SKILL.md:48 SKILL.md:54 SKILL.md:57 SKILL.md:75 SKILL.md:76 SKILL.md:77 SKILL.md:83 SKILL.md:84 SKILL.md:85 SKILL.md:96 SKILL.md:98 SKILL.md:99 SKILL.md:100 SKILL.md:102 SKILL.md:108 SKILL.md:109 SKILL.md:110 SKILL.md:112 SKILL.md:113 SKILL.md:114 SKILL.md:118 SKILL.md:120 SKILL.md:121 SKILL.md:128-135 SKILL.md:135-142 SKILL.md:142-147 SKILL.md:147-151 SKILL.md:151-152
🌐 AccĂšs rĂ©seau (2)
SKILL.md:11 SKILL.md:142
Audité par: codex
Partager et citer ce rapport

Partagez le rapport d’évaluation versionnĂ©, le badge neutre, la carte intĂ©grable et les citations. Skillstore prĂ©sente les preuves sans dĂ©cider si ce Skill est sĂ»r.

Ouvrir le rapport versionné
Évaluation de sĂ©curitĂ©

Copier le lien du rapport

https://skillstore.io/skills/price-win-pricewin-booking-assistant/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/price-win-pricewin-booking-assistant/security.svg)](https://skillstore.io/skills/price-win-pricewin-booking-assistant?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/price-win-pricewin-booking-assistant?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/price-win-pricewin-booking-assistant/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Carte intégrable

<iframe src="https://skillstore.io/embed/skills/price-win-pricewin-booking-assistant.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Citations académiques (APA · BibTeX · CFF)

Citation APA

PriceWin. (2026). pricewin-booking-assistant security audit report (audit version 1) [Author version 1.0.3]. Skillstore. https://skillstore.io/skills/price-win-pricewin-booking-assistant/audits/1

Citation BibTeX

@techreport{pricewin-price-win-pricewin-booking-assistant-2026, author = {PriceWin}, title = {pricewin-booking-assistant security audit report (audit version 1)}, institution = {Skillstore}, year = {2026}, number = {1}, url = {https://skillstore.io/skills/price-win-pricewin-booking-assistant/audits/1}, note = {Author version 1.0.3} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "pricewin-booking-assistant security audit report (audit version 1)" version: "1.0.3" type: report authors: - name: "PriceWin" date-released: "2026-08-16" url: "https://skillstore.io/skills/price-win-pricewin-booking-assistant/audits/1" identifiers: - type: other value: "skillstore:price-win-pricewin-booking-assistant:audit:1" description: "Skillstore immutable audit report identifier"

Score Skillstore

Pourquoi ce score Niveau de confiance des preuves: Moyen
55
Architecture
100
Maintenabilité
87
Contenu
65
Communauté
91
Conformité aux spécifications

Ce que vous pouvez créer

Reserve a Personal Stay

Compare suitable rooms, review the full total, and create a confirmed reservation with a chosen payment method.

Coordinate Business Travel

Shortlist credible hotels and collect guest details before an authorized employee confirms the booking.

Manage an Existing Reservation

Check payment status, replace an expired payment link, or complete a guest-authorized cancellation.

Essayez ces prompts

Find a Hotel 
Find hotels in [city] from [check-in] to [check-out] for [guest count]. Show three strong options within [budget].
Compare Rooms 
Compare available rooms at [hotel] for my dates. Include total price, capacity, rating, review count, and cancellation terms.
Create a Booking 
Book the selected OpenTravel room. Ask for all required guest details, show the complete summary, and wait for my explicit confirmation.
Recover or Cancel a Booking 
For confirmation code [code], check status first. Renew the payment link if expired, or begin token-protected cancellation when requested.

Bonnes pratiques

  • Verify current room details and total price immediately before requesting confirmation.
  • Collect only required guest data and ensure the guest types the email address.
  • Keep the confirmation code and renew expired links instead of creating another booking.

Éviter

  • Do not create a booking before the user confirms every detail and the full total.
  • Do not ask for card numbers, CVV values, bank credentials, or PayPal passwords.
  • Do not present OTA inventory as booked or construct provider URLs manually.

Foire aux questions

Which hotels can this skill book directly?
Only OpenTravel direct properties with a property ID and room type ID can be booked through this skill.
Can it book Booking.com, Agoda, or Traveloka rooms?
No. It can show returned provider links, but the user completes those reservations on the provider site.
Does the skill handle card or bank credentials?
No. It returns a hosted payment link, and the user enters payment credentials on the provider page.
What personal data is transmitted?
PriceWin receives the guest name, phone, email, booking details, payment-method choice, and original request text.
What happens when a payment link expires?
The skill renews the link for the existing confirmation code. It must not create a second reservation.
How does cancellation work?
The guest receives a single-use cancellation token by email and must provide it before cancellation can complete.

Détails du développeur

Auteur

PriceWin

Licence

MIT

Version de l’auteur

v1.0.3

RĂ©vision Skillstore

r1

DĂ©pĂŽt

https://github.com/price-win/pricewin-skills-hub/tree/ea022aa512aaf729d9d91ff4f4a0b9a965f6a521/skills/pricewin-booking-assistant

RĂ©f

45f3d263aa9101b39f66ea71fda13853f0aab6e5

RĂ©cence de maintenance

16/08/2026

Utilisation

0 téléchargements · 0 vues

Structure de fichiers

📄 reference.md

📄 SECURITY.md

📄 skill-card.md

📄 SKILL.md