📦
hotel-core
73Migrate from the deprecated hotel-core skill
The old hotel-core skill no longer provides booking functions. This skill gives a clear path to install the replacement hotel booking skill.
Продуктивность Просмотр
Навыки rollinggo-hotel-booking
📦
rollinggo-hotel-booking
v1.1.1 Ревизия содержимого r2 Высокий риск ⚙️ Внешние команды🌐 Доступ к сети📁 Доступ к файловой системе
Find and book hotels with RollingGo
Finding suitable hotels and comparing room options can take time. This skill searches hotel inventory, presents options, and guides users through a confirmed booking workflow.
Поддерживает: Claude Codex Code(CC)
Остановитесь и запросите подтверждение перед установкой.
Проверьте план и получите явное согласие пользователя перед изменением файлов.
Установить с помощью моего Агента
Скопируйте этот запрос в своего Агента. Он содержит каноническую страницу Skill и манифест.
Запрос агента
Review the Skillstore skill "rollinggo-hotel-booking" from https://skillstore.io/skills/rollinggo-ai-rollinggo-hotel-booking.md and its manifest at https://skillstore.io/api/skills/rollinggo-ai-rollinggo-hotel-booking/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Ваш Агент по-прежнему должен показать план и запросить все подтверждения, требуемые политикой безопасности.
Ресурсы для AI-агентов
Используйте эти ссылки, когда AI-агенту, crawler или script нужен чистый контекст вместо полной страницы.
Протестировать
Использование «rollinggo-hotel-booking». Find a hotel near Beijing Capital Airport for one night.
Ожидаемый результат:
- A short list of nearby hotels with star ratings, reference prices, distances, and key amenities.
- A request to select a hotel for live room details.
Использование «rollinggo-hotel-booking». Compare these two hotels for a family trip.
Ожидаемый результат:
- A side-by-side summary of room prices, breakfast, pool access, distance, and cancellation policies.
- A recommendation based on the stated family requirements.
Использование «rollinggo-hotel-booking». Book the selected room.
Ожидаемый результат:
- A final review of guest details, dates, room type, total price, and cancellation policy.
- A payment link only after explicit booking confirmation.
Аудит безопасности
Высокий рискv2 • 22.07.2026 Открыть версионный отчет
The documentation-only command and URL matches are false positives, but the installer creates an unverified remote-code execution path. It installs a floating npm package or downloads mutable latest release binaries without integrity verification, then makes the binary executable. The booking workflow also submits guest contact data without documented privacy safeguards.
4
Просканировано файлов
733
Проанализировано строк
12
Пункты проверки
0
Ложные срабатывания проигнорированы
Подтверждённые проблемы безопасности (2)
Высокий
Unverified mutable installer sources
The skill directs installation from a floating npm package and latest release assets, then instructs mandatory upgrades. It provides no artifact hash, signature, or immutable version for review.
The installation instructions and script explicitly use @latest and latest release URLs, download an executable, and set executable permissions without a verification step.
Средний
Sensitive booking data lacks stated privacy safeguards
The workflow collects a guest name and email and submits them through an external CLI, but it does not state data handling, retention, consent, or destination safeguards.
The documented booking workflow explicitly collects and forwards identity and contact data. No privacy or data-minimization controls are described in the reviewed materials.
Пункты проверки возможностей (12)
Это реальные локальные возможности, которые могут ожидаться для этого навыка, поэтому они требуют проверки, но не считаются подтверждённым вредоносным поведением.
Высокий
Python subprocess.run
result = subprocess.run(args, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
The helper executes npm install with the floating @latest package version. Package lifecycle code from the registry can run with the installer user privileges, and no integrity pin is used.
Средний
Python file write/append
with open(dest_path, 'wb') as out_file:
The installer writes the remotely downloaded binary to the skill directory before validating its integrity. This makes an unverified remote artifact available for execution.
Средний
Python os file operations
os.chmod(dest_path, 0o755)
The installer marks the downloaded release binary executable without verifying its origin or integrity. This completes the unverified download-to-execution path.
Низкий
Python HTTP libraries
req = urllib.request.Request(
These lines request and download a release asset to disk without a hash, signature, or fixed release identifier. A compromised release or delivery path could supply a substituted executable.
Низкий
Python HTTP libraries
with urllib.request.urlopen(req) as response:
These lines request and download a release asset to disk without a hash, signature, or fixed release identifier. A compromised release or delivery path could supply a substituted executable.
Низкий
Python HTTP libraries
req = urllib.request.Request(
The installer queries the latest GitHub release and trusts the returned asset metadata. The mutable latest endpoint provides no version pinning or artifact verification.
Низкий
Python HTTP libraries
with urllib.request.urlopen(req) as response:
The installer queries the latest GitHub release and trusts the returned asset metadata. The mutable latest endpoint provides no version pinning or artifact verification.
Низкий
Hardcoded URL
api_url = "https://api.github.com/repos/RollingGo-AI/oauth-hotel-cli/releases/latest"
The installer queries the latest GitHub release and trusts the returned asset metadata. The mutable latest endpoint provides no version pinning or artifact verification.
Низкий
Hardcoded URL
download_url = "https://github.com/RollingGo-AI/oauth-hotel-cli/releases/latest/download/rgh-win.exe
This mutable release URL is used to download an executable with no checksum or signature verification. The downloaded file is later made executable.
Низкий
Hardcoded URL
download_url = "https://github.com/RollingGo-AI/oauth-hotel-cli/releases/latest/download/rgh-macos"
This mutable release URL is used to download an executable with no checksum or signature verification. The downloaded file is later made executable.
Низкий
Hardcoded URL
download_url = "https://github.com/RollingGo-AI/oauth-hotel-cli/releases/latest/download/rgh-linux"
This mutable release URL is used to download an executable with no checksum or signature verification. The downloaded file is later made executable.
Низкий
Hardcoded URL
download_url = "https://github.com/RollingGo-AI/oauth-hotel-cli/releases/latest/download/rgh-windows
This mutable release URL is used to download an executable with no checksum or signature verification. The downloaded file is later made executable.
Факторы риска
⚙️ Внешние команды (50)
scripts/install.py:13 scripts/install.py:87 scripts/install.py:88 scripts/install.py:30 SKILL.md:36 SKILL.md:37 SKILL.md:41 SKILL.md:45-47 SKILL.md:47-50 SKILL.md:50 SKILL.md:51-53 SKILL.md:53-56 SKILL.md:56 SKILL.md:57-59 SKILL.md:59 SKILL.md:62 SKILL.md:67 SKILL.md:71-110 SKILL.md:110-118 SKILL.md:118-119 SKILL.md:119-120 SKILL.md:120 SKILL.md:124 SKILL.md:126 SKILL.md:128-131 SKILL.md:131-155 SKILL.md:155-157 SKILL.md:157-173 SKILL.md:173-175 SKILL.md:175-186 SKILL.md:186-202 SKILL.md:202 SKILL.md:204-211 SKILL.md:211-217 SKILL.md:217-219 SKILL.md:219-226 SKILL.md:226-230 SKILL.md:230-234 SKILL.md:234-241 SKILL.md:241 SKILL.md:243-251 SKILL.md:251-253 SKILL.md:253-255 SKILL.md:255-261 SKILL.md:261-263 SKILL.md:263-268 SKILL.md:268-277 SKILL.md:277-281 SKILL.md:281-283 SKILL.md:283-292
🌐 Доступ к сети (15)
📁 Доступ к файловой системе (3)
Аудитор:: claude Посмотреть историю аудитов →
Поделиться и цитировать этот отчет
Делитесь версионным отчетом об оценке, нейтральным значком, встраиваемой карточкой и цитатами. Skillstore публикует доказательства, не решая, безопасен ли этот Skill.
Копировать ссылку на отчёт
https://skillstore.io/skills/rollinggo-ai-rollinggo-hotel-booking/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportЗначок Markdown
[](https://skillstore.io/skills/rollinggo-ai-rollinggo-hotel-booking?utm_source=security_passport_badge)Значок HTML
<a href="https://skillstore.io/skills/rollinggo-ai-rollinggo-hotel-booking?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/rollinggo-ai-rollinggo-hotel-booking/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Встраиваемая карточка
<iframe src="https://skillstore.io/embed/skills/rollinggo-ai-rollinggo-hotel-booking.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Академические ссылки (APA · BibTeX · CFF)
Цитата APA
rollinggo-ai. (2026). rollinggo-hotel-booking security audit report (audit version 2) [Author version 1.1.1]. Skillstore. https://skillstore.io/skills/rollinggo-ai-rollinggo-hotel-booking/audits/2Цитата BibTeX
@techreport{rollinggo-ai-rollinggo-ai-rollinggo-hotel-booking-2026,
author = {rollinggo-ai},
title = {rollinggo-hotel-booking security audit report (audit version 2)},
institution = {Skillstore},
year = {2026},
number = {2},
url = {https://skillstore.io/skills/rollinggo-ai-rollinggo-hotel-booking/audits/2},
note = {Author version 1.1.1}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "rollinggo-hotel-booking security audit report (audit version 2)"
version: "1.1.1"
type: report
authors:
- name: "rollinggo-ai"
date-released: "2026-07-22"
url: "https://skillstore.io/skills/rollinggo-ai-rollinggo-hotel-booking/audits/2"
identifiers:
- type: other
value: "skillstore:rollinggo-ai-rollinggo-hotel-booking:audit:2"
description: "Skillstore immutable audit report identifier"
Оценка Skillstore
Почему такая оценка Достоверность доказательств: Средний 64
Архитектура
100
Сопровождаемость
85
Контент
65
Сообщество
100
Соответствие спецификации
Что вы можете построить
Plan a business stay
Find hotels near an airport, office, or station within a nightly budget.
Compare family-friendly hotels
Compare hotels with breakfast, pools, and family amenities before choosing a room.
Manage hotel reservations
Review room details, confirm a selected price, and check existing hotel orders.
Попробуйте эти промпты
Search for a hotel
Find hotels near Shanghai Bund for two adults next Friday for two nights. My budget is 900 CNY per night.
Filter by amenities
Show family-friendly hotels in Sanya with breakfast and a pool. Compare the best three options.
Review a selected hotel
Show room types, total prices, availability, and cancellation policies for the second hotel.
Prepare a confirmed booking
I choose the deluxe king room. Confirm the current price and show all booking details before creating the order.
Лучшие практики
- Confirm travel dates, guest count, and destination before searching.
- Treat displayed search prices as reference prices until the service confirms them.
- Review the room, cancellation policy, guest information, and total price before creating an order.
Избегать
- Do not create a booking from an ambiguous request.
- Do not share authorization or payment links with unintended recipients.
- Do not assume a room remains available after the displayed price expires.
Часто задаваемые вопросы
What information do I need to search for hotels?
Provide a destination and preferably dates, stay length, and guest count. Budget and amenity preferences are optional.
Are search prices final?
No. Search prices are reference prices. The service confirms the final price before an order is created.
Can I compare hotels?
Yes. The skill can compare hotel prices, distances, amenities, room options, and cancellation policies.
Why do I need to authorize RollingGo?
Authorization lets the RollingGo CLI access the hotel service and manage booking-related requests.
When is a booking created?
Only after you select a room, review the price and details, and explicitly confirm the booking.
Does this skill process payments?
It can return a payment link supplied by the booking service. Payment processing occurs on the external service.
Сведения для разработчиков
Автор
rollinggo-aiЛицензия
MIT
Версия автора
v1.1.1
Ревизия Skillstore
r2
Ссылка
20890ae95db0c3cff5a680c80ddf800f5271c0f9
Актуальность поддержки
23.07.2026
Использование
0 загрузок · 1 просмотров
Структура файлов
Больше от rollinggo-ai
Показать всеСвязанные навыки
Показать все📦
task-state-ledger
90Track Long Tasks With a Portable State Ledger
от glenskii
Long technical tasks lose decisions, evidence, and next actions across sessions. This skill maintains a concise Markdown state file with reviewed local evidence references.
Продуктивность Просмотр
📦
gpt-series-reasoning-style
90Verify AI Deliverables with Evidence
от jadeyingwah
AI work can appear complete before the result is opened, tested, or checked against the request. This skill adds staged planning, real-environment verification, and honest completion levels.
Продуктивность Просмотр
📦
tool-discovery
87Выбирайте подходящий ИИ-инструмент для каждой задачи
от 0xDarkMatter
Выбор среди множества навыков и агентов может замедлять техническую работу. Этот навык сопоставляет каждую задачу со специализированными инструментами, используя краткие каталоги и правила выбора.
Продуктивность Просмотр
📦
prompt-engineering-patterns
86Оптимизация промптов LLM для продакшена
от wshobson
Промпты LLM часто дают сбой из-за неясных инструкций, примеров и критериев оценки. Этот навык предоставляет шаблоны и рабочие процессы для улучшения промптов в Claude, Codex, Claude Code и похожих инструментах.
Продуктивность Просмотр
📦
organizing-with-labels
86Организация GitHub Issues с помощью меток
от C0ntr0lledCha0s
Крупные репозитории теряют время, когда в issues используются несогласованные метки и неясные milestones. Этот skill помогает создавать таксономии, выполнять массовые обновления и отслеживать прогресс через GitHub workflows.
Продуктивность Просмотр
📦
tarot-reading
86Create Reflective Tarot Readings
от gokimedia
Tarot requests can become inconsistent or overconfident without a structured source. This skill uses a bundled 78-card dataset and defined spreads for reflective interpretations.
Продуктивность Просмотр