Навыки pricewin-hotel-deal-finder
📦
pricewin-hotel-deal-finder
v1.1.3 Ревизия содержимого r1 Высокий риск ⚡ Содержит скрипты⚙️ Внешние команды🌐 Доступ к сети📁 Доступ к файловой системе🔑 Переменные окружения
Compare Live Hotel Prices Across Major Sources
Checking several hotel sites takes time and produces inconsistent currencies. This skill searches four sources and presents comparable nightly rates with booking links.
Поддерживает: Claude Codex Code(CC)
Остановитесь и запросите подтверждение перед установкой.
Проверьте план и получите явное согласие пользователя перед изменением файлов.
Установить с помощью моего Агента
Скопируйте этот запрос в своего Агента. Он содержит каноническую страницу Skill и манифест.
Запрос агента
Review the Skillstore skill "pricewin-hotel-deal-finder" from https://skillstore.io/skills/price-win-pricewin-hotel-deal-finder.md and its manifest at https://skillstore.io/api/skills/price-win-pricewin-hotel-deal-finder/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Ваш Агент по-прежнему должен показать план и запросить все подтверждения, требуемые политикой безопасности.
Ресурсы для AI-агентов
Используйте эти ссылки, когда AI-агенту, crawler или script нужен чистый контекст вместо полной страницы.
Протестировать
Использование «pricewin-hotel-deal-finder». Find Tokyo hotels for August 12 to 15 for two adults.
Ожидаемый результат:
A ranked hotel list with nightly USD prices, compared sources, savings differences, and direct booking links.
Использование «pricewin-hotel-deal-finder». Compare Bangkok hotel rates below 100 USD per night.
Ожидаемый результат:
Available lower-priced options grouped by source, plus a clear note when one provider returns no inventory.
Использование «pricewin-hotel-deal-finder». Check Booking.com and Agoda prices for a three-night stay in Paris.
Ожидаемый результат:
A ranked list of observed rates from available sources, with links for hotels that returned booking URLs.
Аудит безопасности
Высокий рискv1 • 16.08.2026 Открыть версионный отчет
Static alerts were false positives caused by template literals, fixed local spawns, expected network and cache activity, loopback services, documentation, and lockfile integrity hashes. Semantic review found high-risk anti-bot evasion and automatic sandbox removal under Linux root. It also found unsafe URL scheme validation, raw snapshot exposure, unsupported ranking labels, and incomplete currency conversion.
12
Просканировано файлов
2,542
Проанализировано строк
0
Пункты проверки
0
Ложные срабатывания проигнорированы
Подтверждённые проблемы безопасности (6)
Высокий
Stealth Automation Evades OTA Bot Detection
The skill deliberately masks browser automation and directs agents to use the stealth path because normal browser automation is detected. This bypasses provider anti-bot controls and may violate access policies.
Both files explicitly describe fingerprint masking, avoiding bot detection, and using Patchright because standard automation is blocked.
Высокий
Chromium Sandbox Automatically Disabled for Linux Root
The daemon adds --no-sandbox whenever it runs as root on Linux. A compromised or malicious hotel page would then execute without Chromium sandbox isolation in a privileged process.
The root check directly adds --no-sandbox before launching Chromium, and the daemon loads remote OTA pages.
Средний
URL Scheme Allowlist Uses an Unsafe Prefix Check
cleanLink claims to allow only HTTP and HTTPS, but startsWith("http") also accepts custom schemes such as httpx. Untrusted provider links can reach formatted output without an exact protocol check.
The implementation checks a string prefix before URL parsing and never verifies that protocol is exactly http: or https:.
Средний
Raw Browser Snapshots Can Expose Indirect Prompt Injection
The snapshot command serializes page text and attributes and prints them for agent use without sanitizeText. A hostile page can place model-directed instructions in this output if the command is used directly.
The snapshot path returns arbitrary visible page text to stdout; the one-shot search avoids exposing it, but the public CLI command remains available.
Средний
Quality and Value Labels Are Based Only on Price
Hotels are sorted only by minimum observed price, then the first three are labeled BEST VALUE, CHEAPEST, and QUALITY. The documented output has no rating or area data to support quality claims.
The ranking expression uses only prices, while the documentation explicitly states that star ratings and area data are unavailable.
Средний
Non-USD and Non-VND Prices Are Misclassified as USD
The extractor recognizes EUR, GBP, THB, and JPY, but toUSD converts only VND and treats every other currency amount as USD. Localized searches can produce materially incorrect comparisons.
The detected currency enum includes five non-USD currencies, while conversion logic has only a VND branch and an assume-USD fallback.
Факторы риска
⚡ Содержит скрипты (3)
⚙️ Внешние команды (50)
bin/browse.js:16 bin/browse.js:98 bin/browse.js:6 bin/browse.js:11 bin/browse.js:52 bin/browse.js:63 bin/browse.js:74 bin/browse.js:75 bin/browse.js:82 bin/browse.js:126 bin/browse.js:162 bin/browse.js:171 bin/browse.js:182 bin/browse.js:183 bin/browse.js:192 bin/browse.js:202 bin/browse.js:204 bin/browse.js:206 bin/browse.js:213 bin/browse.js:229 bin/browse.js:351 bin/browse.js:377 bin/browse.js:387 bin/browse.js:409 bin/browse.js:477 bin/daemon.js:8 bin/daemon.js:9 bin/daemon.js:14 bin/daemon.js:17 bin/daemon.js:79 bin/daemon.js:90 bin/daemon.js:105 bin/daemon.js:156 bin/daemon.js:176 bin/daemon.js:192 bin/daemon.js:244 bin/daemon.js:275 bin/daemon.js:296 bin/daemon.js:315 bin/daemon.js:317 bin/daemon.js:395 bin/daemon.js:477 bin/daemon.js:520 bin/daemon.js:539 bin/daemon.js:562 bin/daemon.js:576 bin/daemon.js:591 bin/search.js:12 bin/search.js:28 bin/search.js:32
🌐 Доступ к сети (38)
bin/browse.js:63 bin/browse.js:75 bin/browse.js:347 bin/browse.js:373 bin/browse.js:320 bin/browse.js:322 bin/browse.js:37 bin/browse.js:63 bin/browse.js:75 bin/browse.js:63 bin/browse.js:75 bin/daemon.js:473 bin/daemon.js:211 bin/daemon.js:53 bin/daemon.js:223 bin/daemon.js:53 bin/daemon.js:54 bin/daemon.js:59 bin/daemon.js:199 bin/daemon.js:212 bin/daemon.js:574 bin/search.js:78 bin/search.js:78 bin/search.js:107 bin/search.js:108 bin/search.js:355 bin/search.js:437 bin/search.js:484 package-lock.json:23 package-lock.json:37 package-lock.json:55 package.json:9 package.json:12 package.json:15 SKILL.md:15 SKILL.md:17 SKILL.md:60 SKILL.md:110
📁 Доступ к файловой системе (44)
bin/browse.js:397 bin/browse.js:24 bin/browse.js:33 bin/browse.js:113 bin/browse.js:113 bin/daemon.js:546 bin/daemon.js:32 bin/daemon.js:33 bin/daemon.js:34 bin/daemon.js:16 bin/daemon.js:16 bin/search.js:146 bin/search.js:160 bin/search.js:165 bin/search.js:172 bin/search.js:175 bin/search.js:200 bin/search.js:217 bin/search.js:469 install.sh:24 install.sh:24 lib/browser-state.js:42 lib/browser-state.js:45 lib/browser-state.js:50 lib/browser-state.js:59 lib/browser-state.js:8 lib/browser-state.js:8 lib/dom-extract.js:54 lib/dom-extract.js:55 lib/dom-extract.js:56 lib/dom-extract.js:57 lib/dom-extract.js:58 lib/selector-cache.js:55 lib/selector-cache.js:63 lib/selector-cache.js:15 lib/selector-cache.js:15 lib/snapshot.js:65 lib/snapshot.js:71 SECURITY.md:41 SECURITY.md:76 SECURITY.md:41 SECURITY.md:76 SKILL.md:73 SKILL.md:73
🔑 Переменные окружения (8)
Аудитор:: codex
Поделиться и цитировать этот отчет
Делитесь версионным отчетом об оценке, нейтральным значком, встраиваемой карточкой и цитатами. Skillstore публикует доказательства, не решая, безопасен ли этот Skill.
Копировать ссылку на отчёт
https://skillstore.io/skills/price-win-pricewin-hotel-deal-finder/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportЗначок Markdown
[](https://skillstore.io/skills/price-win-pricewin-hotel-deal-finder?utm_source=security_passport_badge)Значок HTML
<a href="https://skillstore.io/skills/price-win-pricewin-hotel-deal-finder?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/price-win-pricewin-hotel-deal-finder/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Встраиваемая карточка
<iframe src="https://skillstore.io/embed/skills/price-win-pricewin-hotel-deal-finder.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Академические ссылки (APA · BibTeX · CFF)
Цитата APA
PriceWin. (2026). pricewin-hotel-deal-finder security audit report (audit version 1) [Author version 1.1.3]. Skillstore. https://skillstore.io/skills/price-win-pricewin-hotel-deal-finder/audits/1Цитата BibTeX
@techreport{pricewin-price-win-pricewin-hotel-deal-finder-2026,
author = {PriceWin},
title = {pricewin-hotel-deal-finder security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/price-win-pricewin-hotel-deal-finder/audits/1},
note = {Author version 1.1.3}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "pricewin-hotel-deal-finder security audit report (audit version 1)"
version: "1.1.3"
type: report
authors:
- name: "PriceWin"
date-released: "2026-08-16"
url: "https://skillstore.io/skills/price-win-pricewin-hotel-deal-finder/audits/1"
identifiers:
- type: other
value: "skillstore:price-win-pricewin-hotel-deal-finder:audit:1"
description: "Skillstore immutable audit report identifier"
Оценка Skillstore
Почему такая оценка Достоверность доказательств: Средний 55
Архитектура
100
Сопровождаемость
85
Контент
65
Сообщество
91
Соответствие спецификации
Что вы можете построить
Plan a personal trip
Compare nightly rates across several sources before choosing a hotel.
Check a travel budget
Find lower-priced stays for fixed dates and a defined guest count.
Research accommodation options
Review source coverage and booking links for a destination shortlist.
Попробуйте эти промпты
Basic city search
Find hotel prices in {city} from {check_in} to {check_out} for {adults} adults.Budget comparison
Compare hotel rates in {city} for {dates}. Highlight options near {nightly_budget} per night.Source comparison
Search {city} for {dates} and compare returned hotels across Booking.com, Agoda, Google Hotels, and OpenTravel.Advanced localized search
Search {city} for {dates}, {adults} adults, and locale {locale}. Report partial sources and preserve valid booking links.Лучшие практики
- Provide an exact city, check-in date, check-out date, and adult count.
- Verify taxes, cancellation terms, room type, and final totals on the booking page.
- Treat missing sources as partial coverage and retry only when current prices are essential.
Избегать
- Do not treat displayed rates as guaranteed final booking totals.
- Do not infer hotel quality from the current price-only ranking labels.
- Do not use the skill for authenticated accounts, private rates, or personal booking data.
Часто задаваемые вопросы
Which hotel sources does this skill search?
It searches Booking.com, Agoda, Google Hotels, and the OpenTravel public hotel endpoint.
Does it book a hotel for me?
No. It presents observed rates and links so you can review and complete the booking.
Why can the first search take several minutes?
Agoda may require city-specific selector discovery before the skill can extract its listings.
Are all prices final totals?
No. Taxes, fees, room conditions, and provider changes may alter the final amount.
Why is a source missing from the results?
A provider may block automation, have no inventory, change its page structure, or time out.
What data leaves my machine?
The search city, dates, guest count, and locale are sent to hotel sources. An exchange-rate request carries no search details.