Habilidades pricewin-hotel-deal-finder
📦
pricewin-hotel-deal-finder
v1.1.3 Revisão do conteúdo r1 Risco alto ⚡ Contém scripts⚙️ Comandos externos🌐 Acesso à rede📁 Acesso ao sistema de arquivos🔑 Variáveis de ambiente
Compare Live Hotel Prices Across Major Sources
Checking several hotel sites takes time and produces inconsistent currencies. This skill searches four sources and presents comparable nightly rates with booking links.
Suporta: Claude Codex Code(CC)
Pare e solicite confirmação antes de instalar.
Revise o plano e obtenha o consentimento explícito do usuário antes de alterar arquivos.
Instalar com meu Agente
Copie esta solicitação para o seu Agente. Ela inclui a página canônica do Skill e o manifesto.
Solicitação do agente
Review the Skillstore skill "pricewin-hotel-deal-finder" from https://skillstore.io/skills/price-win-pricewin-hotel-deal-finder.md and its manifest at https://skillstore.io/api/skills/price-win-pricewin-hotel-deal-finder/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Seu Agente ainda deve apresentar o plano e solicitar qualquer confirmação exigida pela política de segurança.
Recursos legíveis por agentes
Use estes links quando um agente de IA, crawler ou script precisar de contexto limpo em vez de ler a página completa.
Testar
Usando "pricewin-hotel-deal-finder". Find Tokyo hotels for August 12 to 15 for two adults.
Resultado esperado:
A ranked hotel list with nightly USD prices, compared sources, savings differences, and direct booking links.
Usando "pricewin-hotel-deal-finder". Compare Bangkok hotel rates below 100 USD per night.
Resultado esperado:
Available lower-priced options grouped by source, plus a clear note when one provider returns no inventory.
Usando "pricewin-hotel-deal-finder". Check Booking.com and Agoda prices for a three-night stay in Paris.
Resultado esperado:
A ranked list of observed rates from available sources, with links for hotels that returned booking URLs.
Auditoria de segurança
Risco altov1 • 16/08/2026 Abrir o relatório versionado
Static alerts were false positives caused by template literals, fixed local spawns, expected network and cache activity, loopback services, documentation, and lockfile integrity hashes. Semantic review found high-risk anti-bot evasion and automatic sandbox removal under Linux root. It also found unsafe URL scheme validation, raw snapshot exposure, unsupported ranking labels, and incomplete currency conversion.
12
Arquivos analisados
2,542
Linhas analisadas
0
Itens de revisão
0
Falsos positivos ignorados
Preocupações de segurança confirmadas (6)
Alto
Stealth Automation Evades OTA Bot Detection
The skill deliberately masks browser automation and directs agents to use the stealth path because normal browser automation is detected. This bypasses provider anti-bot controls and may violate access policies.
Both files explicitly describe fingerprint masking, avoiding bot detection, and using Patchright because standard automation is blocked.
Alto
Chromium Sandbox Automatically Disabled for Linux Root
The daemon adds --no-sandbox whenever it runs as root on Linux. A compromised or malicious hotel page would then execute without Chromium sandbox isolation in a privileged process.
The root check directly adds --no-sandbox before launching Chromium, and the daemon loads remote OTA pages.
Médio
URL Scheme Allowlist Uses an Unsafe Prefix Check
cleanLink claims to allow only HTTP and HTTPS, but startsWith("http") also accepts custom schemes such as httpx. Untrusted provider links can reach formatted output without an exact protocol check.
The implementation checks a string prefix before URL parsing and never verifies that protocol is exactly http: or https:.
Médio
Raw Browser Snapshots Can Expose Indirect Prompt Injection
The snapshot command serializes page text and attributes and prints them for agent use without sanitizeText. A hostile page can place model-directed instructions in this output if the command is used directly.
The snapshot path returns arbitrary visible page text to stdout; the one-shot search avoids exposing it, but the public CLI command remains available.
Médio
Quality and Value Labels Are Based Only on Price
Hotels are sorted only by minimum observed price, then the first three are labeled BEST VALUE, CHEAPEST, and QUALITY. The documented output has no rating or area data to support quality claims.
The ranking expression uses only prices, while the documentation explicitly states that star ratings and area data are unavailable.
Médio
Non-USD and Non-VND Prices Are Misclassified as USD
The extractor recognizes EUR, GBP, THB, and JPY, but toUSD converts only VND and treats every other currency amount as USD. Localized searches can produce materially incorrect comparisons.
The detected currency enum includes five non-USD currencies, while conversion logic has only a VND branch and an assume-USD fallback.
Fatores de risco
⚡ Contém scripts (3)
⚙️ Comandos externos (50)
bin/browse.js:16 bin/browse.js:98 bin/browse.js:6 bin/browse.js:11 bin/browse.js:52 bin/browse.js:63 bin/browse.js:74 bin/browse.js:75 bin/browse.js:82 bin/browse.js:126 bin/browse.js:162 bin/browse.js:171 bin/browse.js:182 bin/browse.js:183 bin/browse.js:192 bin/browse.js:202 bin/browse.js:204 bin/browse.js:206 bin/browse.js:213 bin/browse.js:229 bin/browse.js:351 bin/browse.js:377 bin/browse.js:387 bin/browse.js:409 bin/browse.js:477 bin/daemon.js:8 bin/daemon.js:9 bin/daemon.js:14 bin/daemon.js:17 bin/daemon.js:79 bin/daemon.js:90 bin/daemon.js:105 bin/daemon.js:156 bin/daemon.js:176 bin/daemon.js:192 bin/daemon.js:244 bin/daemon.js:275 bin/daemon.js:296 bin/daemon.js:315 bin/daemon.js:317 bin/daemon.js:395 bin/daemon.js:477 bin/daemon.js:520 bin/daemon.js:539 bin/daemon.js:562 bin/daemon.js:576 bin/daemon.js:591 bin/search.js:12 bin/search.js:28 bin/search.js:32
🌐 Acesso à rede (38)
bin/browse.js:63 bin/browse.js:75 bin/browse.js:347 bin/browse.js:373 bin/browse.js:320 bin/browse.js:322 bin/browse.js:37 bin/browse.js:63 bin/browse.js:75 bin/browse.js:63 bin/browse.js:75 bin/daemon.js:473 bin/daemon.js:211 bin/daemon.js:53 bin/daemon.js:223 bin/daemon.js:53 bin/daemon.js:54 bin/daemon.js:59 bin/daemon.js:199 bin/daemon.js:212 bin/daemon.js:574 bin/search.js:78 bin/search.js:78 bin/search.js:107 bin/search.js:108 bin/search.js:355 bin/search.js:437 bin/search.js:484 package-lock.json:23 package-lock.json:37 package-lock.json:55 package.json:9 package.json:12 package.json:15 SKILL.md:15 SKILL.md:17 SKILL.md:60 SKILL.md:110
📁 Acesso ao sistema de arquivos (44)
bin/browse.js:397 bin/browse.js:24 bin/browse.js:33 bin/browse.js:113 bin/browse.js:113 bin/daemon.js:546 bin/daemon.js:32 bin/daemon.js:33 bin/daemon.js:34 bin/daemon.js:16 bin/daemon.js:16 bin/search.js:146 bin/search.js:160 bin/search.js:165 bin/search.js:172 bin/search.js:175 bin/search.js:200 bin/search.js:217 bin/search.js:469 install.sh:24 install.sh:24 lib/browser-state.js:42 lib/browser-state.js:45 lib/browser-state.js:50 lib/browser-state.js:59 lib/browser-state.js:8 lib/browser-state.js:8 lib/dom-extract.js:54 lib/dom-extract.js:55 lib/dom-extract.js:56 lib/dom-extract.js:57 lib/dom-extract.js:58 lib/selector-cache.js:55 lib/selector-cache.js:63 lib/selector-cache.js:15 lib/selector-cache.js:15 lib/snapshot.js:65 lib/snapshot.js:71 SECURITY.md:41 SECURITY.md:76 SECURITY.md:41 SECURITY.md:76 SKILL.md:73 SKILL.md:73
🔑 Variáveis de ambiente (8)
Auditado por: codex
Compartilhar e citar este relatório
Compartilhe o relatório de avaliação versionado, o badge neutro, o cartão incorporável e as citações. A Skillstore apresenta evidências sem decidir se este Skill é seguro.
Copiar link do relatório
https://skillstore.io/skills/price-win-pricewin-hotel-deal-finder/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportBadge Markdown
[](https://skillstore.io/skills/price-win-pricewin-hotel-deal-finder?utm_source=security_passport_badge)Badge HTML
<a href="https://skillstore.io/skills/price-win-pricewin-hotel-deal-finder?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/price-win-pricewin-hotel-deal-finder/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Cartão incorporável
<iframe src="https://skillstore.io/embed/skills/price-win-pricewin-hotel-deal-finder.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Citações acadêmicas (APA · BibTeX · CFF)
Citação APA
PriceWin. (2026). pricewin-hotel-deal-finder security audit report (audit version 1) [Author version 1.1.3]. Skillstore. https://skillstore.io/skills/price-win-pricewin-hotel-deal-finder/audits/1Citação BibTeX
@techreport{pricewin-price-win-pricewin-hotel-deal-finder-2026,
author = {PriceWin},
title = {pricewin-hotel-deal-finder security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/price-win-pricewin-hotel-deal-finder/audits/1},
note = {Author version 1.1.3}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "pricewin-hotel-deal-finder security audit report (audit version 1)"
version: "1.1.3"
type: report
authors:
- name: "PriceWin"
date-released: "2026-08-16"
url: "https://skillstore.io/skills/price-win-pricewin-hotel-deal-finder/audits/1"
identifiers:
- type: other
value: "skillstore:price-win-pricewin-hotel-deal-finder:audit:1"
description: "Skillstore immutable audit report identifier"
Pontuação do Skillstore
Por que esta pontuação Confiança das evidências: Médio 55
Arquitetura
100
Manutenibilidade
85
Conteúdo
65
Comunidade
91
Conformidade com a especificação
O que você pode criar
Plan a personal trip
Compare nightly rates across several sources before choosing a hotel.
Check a travel budget
Find lower-priced stays for fixed dates and a defined guest count.
Research accommodation options
Review source coverage and booking links for a destination shortlist.
Teste estes prompts
Basic city search
Find hotel prices in {city} from {check_in} to {check_out} for {adults} adults.Budget comparison
Compare hotel rates in {city} for {dates}. Highlight options near {nightly_budget} per night.Source comparison
Search {city} for {dates} and compare returned hotels across Booking.com, Agoda, Google Hotels, and OpenTravel.Advanced localized search
Search {city} for {dates}, {adults} adults, and locale {locale}. Report partial sources and preserve valid booking links.Boas práticas
- Provide an exact city, check-in date, check-out date, and adult count.
- Verify taxes, cancellation terms, room type, and final totals on the booking page.
- Treat missing sources as partial coverage and retry only when current prices are essential.
Evitar
- Do not treat displayed rates as guaranteed final booking totals.
- Do not infer hotel quality from the current price-only ranking labels.
- Do not use the skill for authenticated accounts, private rates, or personal booking data.
Perguntas frequentes
Which hotel sources does this skill search?
It searches Booking.com, Agoda, Google Hotels, and the OpenTravel public hotel endpoint.
Does it book a hotel for me?
No. It presents observed rates and links so you can review and complete the booking.
Why can the first search take several minutes?
Agoda may require city-specific selector discovery before the skill can extract its listings.
Are all prices final totals?
No. Taxes, fees, room conditions, and provider changes may alter the final amount.
Why is a source missing from the results?
A provider may block automation, have no inventory, change its page structure, or time out.
What data leaves my machine?
The search city, dates, guest count, and locale are sent to hotel sources. An exchange-rate request carries no search details.