Skills pricewin-price-comparison

📦

pricewin-price-comparison

Name: pricewin-price-comparison
Author: PriceWin

v1.0.3 Content revision r1 Medium Risk 📁 Filesystem access⚙️ External commands🌐 Network access

Compare Live Hotel Rates Across Booking Sites

Hotel rates and cancellation terms vary across booking providers. This skill compares live results from supported sources and identifies the lowest available rate.

Supports: Claude Codex Code(CC)

📊 72 Adequate

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "pricewin-price-comparison" from https://skillstore.io/skills/price-win-pricewin-price-comparison.md and its manifest at https://skillstore.io/api/skills/price-win-pricewin-price-comparison/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/price-win-pricewin-price-comparison.md Signed manifest GET /api/skills/price-win-pricewin-price-comparison/manifest Signed lockfile GET /api/skills/price-win-pricewin-price-comparison/lockfile

Test it

Using "pricewin-price-comparison". Compare hotels in Da Nang for two adults from September 10 to September 13.

Expected outcome:

Ocean View Hotel: Agoda is lowest at USD 82 per night.
Booking.com is USD 89, and OpenTravel is USD 91.
The Agoda rate saves 7.9 percent against the next lowest source.

Using "pricewin-price-comparison". Is Mercure Danang cheaper on Agoda or Booking.com for my selected dates?

Expected outcome:

Agoda: USD 74 per night.
Booking.com: USD 79 per night.
Agoda is USD 5 lower, subject to current availability.

Using "pricewin-price-comparison". Find the best flexible OpenTravel room at this property.

Expected outcome:

Flexible King Room: USD 118 per night.
Free cancellation is available until the provider-reported deadline.
The non-refundable option is USD 109 per night.

Security Audit

Medium Risk

v1 • 8/16/2026 Open versioned report

The path traversal and command execution alerts are false positives caused by relative Markdown links and inline code formatting. The skill does direct agents to a hosted MCP endpoint and can transmit the user's original message verbatim, creating a real privacy boundary.

Files scanned

277

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

Medium

SKILL.md:85-88 SECURITY.md:38-40

Verbatim User Message Sent to Hosted Service

The skill recommends sending queryText containing the user's original request verbatim to a closed-source hosted MCP service. Unrelated personal data may leave the local environment.

Both files explicitly state that queryText is the user's original request and is sent to PriceWin's hosted server. SECURITY.md also warns that personal context may be included.

Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Low

SKILL.md:88

Hardcoded URL

`https://mcp.price.win/mcp` (no credentials, no account). No PII, and this skill

This is the declared hosted MCP endpoint, and using the skill transmits travel query fields to it. The network access is expected but creates a real external data boundary.

Risk Factors

📁 Filesystem access (3)

SECURITY.md:23 SECURITY.md:50 SKILL.md:38

⚙️ External commands (28)

🌐 Network access (2)

SKILL.md:11 SKILL.md:88

Audited by: codex

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/price-win-pricewin-price-comparison/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/price-win-pricewin-price-comparison/security.svg)](https://skillstore.io/skills/price-win-pricewin-price-comparison?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/price-win-pricewin-price-comparison?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/price-win-pricewin-price-comparison/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/price-win-pricewin-price-comparison.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

PriceWin. (2026). pricewin-price-comparison security audit report (audit version 1) [Author version 1.0.3]. Skillstore. https://skillstore.io/skills/price-win-pricewin-price-comparison/audits/1

BibTeX citation

@techreport{pricewin-price-win-pricewin-price-comparison-2026,
  author = {PriceWin},
  title = {pricewin-price-comparison security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/price-win-pricewin-price-comparison/audits/1},
  note = {Author version 1.0.3}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "pricewin-price-comparison security audit report (audit version 1)"
version: "1.0.3"
type: report
authors:
  - name: "PriceWin"
date-released: "2026-08-16"
url: "https://skillstore.io/skills/price-win-pricewin-price-comparison/audits/1"
identifiers:
  - type: other
    value: "skillstore:price-win-pricewin-price-comparison:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Compare a City Stay

Search several providers for specific dates and rank each hotel by its lowest returned rate.

Check a Named Hotel

Compare room prices for one selected property across Booking.com and Agoda.

Review Cancellation Terms

Inspect OpenTravel rate plans and identify free-cancellation deadlines before presenting options.

Try These Prompts

Basic City Comparison

Compare hotel prices in {city} from {check-in} to {check-out} for {guests}. Show the cheapest source for each hotel.

Named Hotel Check

Compare live room rates for {hotel} in {city} from {check-in} to {check-out}. List each provider and identify the lowest price.

Flexible Rate Review

Compare rates for {hotel or city} on {dates}. Prefer free cancellation when the price difference is small, and explain the tradeoff.

Detailed Multi-Source Analysis

Compare {hotel or city} for {dates and guests}. Show room-level prices, calculate savings, review available cancellation terms, and cite every returned provider link.

Best Practices

Provide exact dates, guest counts, and the city or hotel name.
Compare every returned source and show the retrieval context with each result.
Verify the final price and policy on the provider page before booking.

Avoid

Do not send personal details through the free-text query field.
Do not treat a cached rate as a guaranteed booking price.
Do not infer structured cancellation terms for OTA results.

Frequently Asked Questions

Which hotel providers can this skill compare?

It compares returned rates from Booking.com, Agoda, Traveloka, and OpenTravel.

Does the skill require an external service?

Yes. It requires the PriceWin MCP server for live searches and property details.

What information is sent to the service?

Travel query fields are sent, including location, dates, guest counts, identifiers, and sometimes the original request text.

Can it book a room?

No. It only compares information and cannot make reservations or payments.

Are prices guaranteed?

No. Rates and availability can change, so users should verify them on the provider page.

Does it compare cancellation policies?

It retrieves structured policies for OpenTravel rate plans and relays provider-reported text for OTA results.

Developer Details

Author

PriceWin

License

MIT

Author version

v1.0.3

Skillstore revision

Repository

https://github.com/price-win/pricewin-skills-hub/tree/ea022aa512aaf729d9d91ff4f4a0b9a965f6a521/skills/pricewin-price-comparison

Ref

fffe9a62369d0b42a0ecc587c533a81177ca4cd8

Maintenance freshness

8/16/2026

Usage

0 downloads · 0 views

File structure

📄 reference.md

📄 SECURITY.md

📄 skill-card.md

📄 SKILL.md