Skills pricewin-hotel-deal-finder

📦

pricewin-hotel-deal-finder

Name: pricewin-hotel-deal-finder
Author: PriceWin

v1.1.3 Content revision r1 High Risk ⚡ Contains scripts⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables

Compare Live Hotel Prices Across Major Sources

Checking several hotel sites takes time and produces inconsistent currencies. This skill searches four sources and presents comparable nightly rates with booking links.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Maintain this Skill? Claim it ⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "pricewin-hotel-deal-finder" from https://skillstore.io/skills/price-win-pricewin-hotel-deal-finder.md and its manifest at https://skillstore.io/api/skills/price-win-pricewin-hotel-deal-finder/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/price-win-pricewin-hotel-deal-finder.md Signed manifest GET /api/skills/price-win-pricewin-hotel-deal-finder/manifest Signed lockfile GET /api/skills/price-win-pricewin-hotel-deal-finder/lockfile

Test it

Using "pricewin-hotel-deal-finder". Find Tokyo hotels for August 12 to 15 for two adults.

Expected outcome:

A ranked hotel list with nightly USD prices, compared sources, savings differences, and direct booking links.

Using "pricewin-hotel-deal-finder". Compare Bangkok hotel rates below 100 USD per night.

Expected outcome:

Available lower-priced options grouped by source, plus a clear note when one provider returns no inventory.

Using "pricewin-hotel-deal-finder". Check Booking.com and Agoda prices for a three-night stay in Paris.

Expected outcome:

A ranked list of observed rates from available sources, with links for hotels that returned booking URLs.

Security Audit

High Risk

v1 • 8/16/2026 Open versioned report

Static alerts were false positives caused by template literals, fixed local spawns, expected network and cache activity, loopback services, documentation, and lockfile integrity hashes. Semantic review found high-risk anti-bot evasion and automatic sandbox removal under Linux root. It also found unsafe URL scheme validation, raw snapshot exposure, unsupported ranking labels, and incomplete currency conversion.

Files scanned

2,542

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (6)

High

SKILL.md:94-104 SECURITY.md:30-38

Stealth Automation Evades OTA Bot Detection

The skill deliberately masks browser automation and directs agents to use the stealth path because normal browser automation is detected. This bypasses provider anti-bot controls and may violate access policies.

Both files explicitly describe fingerprint masking, avoiding bot detection, and using Patchright because standard automation is blocked.

High

bin/daemon.js:160-179

Chromium Sandbox Automatically Disabled for Linux Root

The daemon adds --no-sandbox whenever it runs as root on Linux. A compromised or malicious hotel page would then execute without Chromium sandbox isolation in a privileged process.

The root check directly adds --no-sandbox before launching Chromium, and the daemon loads remote OTA pages.

Medium

bin/search.js:103-141

URL Scheme Allowlist Uses an Unsafe Prefix Check

cleanLink claims to allow only HTTP and HTTPS, but startsWith("http") also accepts custom schemes such as httpx. Untrusted provider links can reach formatted output without an exact protocol check.

The implementation checks a string prefix before URL parsing and never verifies that protocol is exactly http: or https:.

Medium

lib/snapshot.js:121-180 bin/browse.js:121-126

Raw Browser Snapshots Can Expose Indirect Prompt Injection

The snapshot command serializes page text and attributes and prints them for agent use without sanitizeText. A hostile page can place model-directed instructions in this output if the command is used directly.

The snapshot path returns arbitrary visible page text to stdout; the one-shot search avoids exposing it, but the public CLI command remains available.

Medium

bin/search.js:246-265 SKILL.md:122-124

Quality and Value Labels Are Based Only on Price

Hotels are sorted only by minimum observed price, then the first three are labeled BEST VALUE, CHEAPEST, and QUALITY. The documented output has no rating or area data to support quality claims.

The ranking expression uses only prices, while the documentation explicitly states that star ratings and area data are unavailable.

Medium

lib/dom-extract.js:52-60 bin/search.js:84-89

Non-USD and Non-VND Prices Are Misclassified as USD

The extractor recognizes EUR, GBP, THB, and JPY, but toUSD converts only VND and treats every other currency amount as USD. Localized searches can produce materially incorrect comparisons.

The detected currency enum includes five non-USD currencies, while conversion logic has only a VND branch and an assume-USD fallback.

Risk Factors

⚡ Contains scripts (3)

bin/browse.js:392 bin/browse.js:393 bin/browse.js:394

⚙️ External commands (50)

bin/browse.js:16 bin/browse.js:98 bin/browse.js:6 bin/browse.js:11 bin/browse.js:52 bin/browse.js:63 bin/browse.js:74 bin/browse.js:75 bin/browse.js:82 bin/browse.js:126 bin/browse.js:162 bin/browse.js:171 bin/browse.js:182 bin/browse.js:183 bin/browse.js:192 bin/browse.js:202 bin/browse.js:204 bin/browse.js:206 bin/browse.js:213 bin/browse.js:229 bin/browse.js:351 bin/browse.js:377 bin/browse.js:387 bin/browse.js:409 bin/browse.js:477 bin/daemon.js:8 bin/daemon.js:9 bin/daemon.js:14 bin/daemon.js:17 bin/daemon.js:79 bin/daemon.js:90 bin/daemon.js:105 bin/daemon.js:156 bin/daemon.js:176 bin/daemon.js:192 bin/daemon.js:244 bin/daemon.js:275 bin/daemon.js:296 bin/daemon.js:315 bin/daemon.js:317 bin/daemon.js:395 bin/daemon.js:477 bin/daemon.js:520 bin/daemon.js:539 bin/daemon.js:562 bin/daemon.js:576 bin/daemon.js:591 bin/search.js:12 bin/search.js:28 bin/search.js:32

🌐 Network access (38)

📁 Filesystem access (44)

bin/browse.js:397 bin/browse.js:24 bin/browse.js:33 bin/browse.js:113 bin/browse.js:113 bin/daemon.js:546 bin/daemon.js:32 bin/daemon.js:33 bin/daemon.js:34 bin/daemon.js:16 bin/daemon.js:16 bin/search.js:146 bin/search.js:160 bin/search.js:165 bin/search.js:172 bin/search.js:175 bin/search.js:200 bin/search.js:217 bin/search.js:469 install.sh:24 install.sh:24 lib/browser-state.js:42 lib/browser-state.js:45 lib/browser-state.js:50 lib/browser-state.js:59 lib/browser-state.js:8 lib/browser-state.js:8 lib/dom-extract.js:54 lib/dom-extract.js:55 lib/dom-extract.js:56 lib/dom-extract.js:57 lib/dom-extract.js:58 lib/selector-cache.js:55 lib/selector-cache.js:63 lib/selector-cache.js:15 lib/selector-cache.js:15 lib/snapshot.js:65 lib/snapshot.js:71 SECURITY.md:41 SECURITY.md:76 SECURITY.md:41 SECURITY.md:76 SKILL.md:73 SKILL.md:73

🔑 Env variables (8)

bin/browse.js:340 bin/browse.js:365 bin/browse.js:340 bin/browse.js:365 bin/daemon.js:174 bin/daemon.js:187 bin/daemon.js:174 bin/daemon.js:187

Audited by: codex

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/price-win-pricewin-hotel-deal-finder/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/price-win-pricewin-hotel-deal-finder/security.svg)](https://skillstore.io/skills/price-win-pricewin-hotel-deal-finder?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/price-win-pricewin-hotel-deal-finder?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/price-win-pricewin-hotel-deal-finder/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/price-win-pricewin-hotel-deal-finder.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

PriceWin. (2026). pricewin-hotel-deal-finder security audit report (audit version 1) [Author version 1.1.3]. Skillstore. https://skillstore.io/skills/price-win-pricewin-hotel-deal-finder/audits/1

BibTeX citation

@techreport{pricewin-price-win-pricewin-hotel-deal-finder-2026,
  author = {PriceWin},
  title = {pricewin-hotel-deal-finder security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/price-win-pricewin-hotel-deal-finder/audits/1},
  note = {Author version 1.1.3}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "pricewin-hotel-deal-finder security audit report (audit version 1)"
version: "1.1.3"
type: report
authors:
  - name: "PriceWin"
date-released: "2026-08-16"
url: "https://skillstore.io/skills/price-win-pricewin-hotel-deal-finder/audits/1"
identifiers:
  - type: other
    value: "skillstore:price-win-pricewin-hotel-deal-finder:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Plan a personal trip

Compare nightly rates across several sources before choosing a hotel.

Check a travel budget

Find lower-priced stays for fixed dates and a defined guest count.

Research accommodation options

Review source coverage and booking links for a destination shortlist.

Try These Prompts

Basic city search

Find hotel prices in {city} from {check_in} to {check_out} for {adults} adults.

Budget comparison

Compare hotel rates in {city} for {dates}. Highlight options near {nightly_budget} per night.

Source comparison

Search {city} for {dates} and compare returned hotels across Booking.com, Agoda, Google Hotels, and OpenTravel.

Advanced localized search

Search {city} for {dates}, {adults} adults, and locale {locale}. Report partial sources and preserve valid booking links.

Best Practices

Provide an exact city, check-in date, check-out date, and adult count.
Verify taxes, cancellation terms, room type, and final totals on the booking page.
Treat missing sources as partial coverage and retry only when current prices are essential.

Avoid

Do not treat displayed rates as guaranteed final booking totals.
Do not infer hotel quality from the current price-only ranking labels.
Do not use the skill for authenticated accounts, private rates, or personal booking data.