Versioned security assessment

Report ID: SA-62E2A730

7/5/2026, 8:56:19 PM

rollinggo-searchhotel security assessment v4

Skill Security Certification Report

Audit History

Audit model: codex Latest published report

Skill name: rollinggo-searchhotel
Version: v4
Maintainer: RollingGo-AI
Source: github.com/RollingGo-AI/rollinggo-skills/tree/main/rollinggo-hotel-cn/
Coverage: 4 Files scanned · 584 Lines analyzed
Policy version: Unavailable

Highest confirmed finding severity

High

5 confirmed security findings require attention.

Installation context

Check the current Skill page

This page summarizes report evidence only. The Skill page provides the canonical install advisory.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

The skill is not overtly malicious and I found no prompt injection attempt. It does handle a RollingGo API key and directs users to run mutable third-party CLI packages, so the main risks are credential exposure and supply-chain drift.

Report position

Latest published report

Latest refers to the report sequence, not to artifact currentness.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

4 Files scanned · 584 Lines analyzed

37 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

Source

Commit and path bound
Artifact

Content and tree hashes bound
Audit

Complete
Install contract

Open manifest to verify
Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 2 evidence locations

Filesystem access

May read or write local files.

Observed in 1 evidence location

Env variables

May read values from the process environment.

Observed in 21 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 21 evidence locations

Capability review items (32)

High

references/claw-host-env.md:31

Hidden file in home directory

或写入宿主的 `.env` 文件:`~/.openclaw/.env`(macOS/Linux)/ `%USERPROFILE%\.openclaw\.env`(Windows)。

The documentation recommends storing or injecting the API key in host or sandbox configuration. This can persist secrets and broaden exposure if the configuration is shared.

High

references/claw-host-env.md:3

Generic API/secret keys

本技能需要在进程里能读到 `RollingGo_API_KEY`。如果宿主在不同 run 间丢失该变量,请使用宿主级注入而非 shell export。

The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.

High

references/claw-host-env.md:18

Generic API/secret keys

"env": { "RollingGo_API_KEY": "YOUR_KEY" }

The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.

High

references/claw-host-env.md:28

Generic API/secret keys

{ "env": { "RollingGo_API_KEY": "YOUR_KEY" } }

The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.

High

references/claw-host-env.md:44

Generic API/secret keys

宿主 env 配置**不会**自动传入 sandbox 进程。需在 sandbox 内直接注入 `RollingGo_API_KEY`:`agents.defaults.sandbox.docker.

The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.

High

references/rollinggo-npx.md:69

Generic API/secret keys

解析顺序:`--api-key` 参数 → `RollingGo_API_KEY` 环境变量。

The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.

High

references/rollinggo-npx.md:73

Generic API/secret keys

export RollingGo_API_KEY="YOUR_API_KEY"

The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.

High

references/rollinggo-npx.md:76

Generic API/secret keys

$env:RollingGo_API_KEY="YOUR_API_KEY"

The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.

High

references/rollinggo-npx.md:79

Generic API/secret keys

rollinggo hotel-tags --api-key YOUR_API_KEY

This line documents passing an API key on the command line, which can expose secrets through shell history or process listings. The example uses placeholders, but the usage pattern is real.

High

references/rollinggo-npx.md:82

Generic API/secret keys

宿主经常丢失 `RollingGo_API_KEY` 时,见 [claw-host-env.md](claw-host-env.md)。

The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.

High

references/rollinggo-npx.md:145

Generic API/secret keys

rollinggo hotel-tags --api-key YOUR_API_KEY

This line documents passing an API key on the command line, which can expose secrets through shell history or process listings. The example uses placeholders, but the usage pattern is real.

High

references/rollinggo-npx.md:188

Generic API/secret keys

- **缺少 API Key 报错:** 传入 `--api-key`、设置 `RollingGo_API_KEY`,或者如果你跑在任何 claw 风格宿主里,就按 [claw-host-env.md

The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.

High

references/rollinggo-uv.md:70

Generic API/secret keys

解析顺序:`--api-key` 参数 → `RollingGo_API_KEY` 环境变量。

The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.

High

references/rollinggo-uv.md:74

Generic API/secret keys

export RollingGo_API_KEY="YOUR_API_KEY"

The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.

High

references/rollinggo-uv.md:77

Generic API/secret keys

$env:RollingGo_API_KEY="YOUR_API_KEY"

The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.

High

references/rollinggo-uv.md:80

Generic API/secret keys

rollinggo hotel-tags --api-key YOUR_API_KEY

This line documents passing an API key on the command line, which can expose secrets through shell history or process listings. The example uses placeholders, but the usage pattern is real.

High

references/rollinggo-uv.md:83

Generic API/secret keys

宿主经常丢失 `RollingGo_API_KEY` 时,见 [claw-host-env.md](claw-host-env.md)。

The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.

High

references/rollinggo-uv.md:146

Generic API/secret keys

rollinggo hotel-tags --api-key YOUR_API_KEY

This line documents passing an API key on the command line, which can expose secrets through shell history or process listings. The example uses placeholders, but the usage pattern is real.

High

references/rollinggo-uv.md:192

Generic API/secret keys

- **缺少 API Key 报错:** 传入 `--api-key`、设置 `RollingGo_API_KEY`,或者如果你跑在任何 claw 风格宿主里,就按 [claw-host-env.md

The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.

High

SKILL.md:10

Generic API/secret keys

"primaryEnv": "RollingGo_API_KEY",

The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.

High

SKILL.md:13

Generic API/secret keys

"env": ["RollingGo_API_KEY"]

The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.

High

SKILL.md:45

Generic API/secret keys

解析顺序:`--api-key` 参数 → `RollingGo_API_KEY` 环境变量。

The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.

Medium

references/claw-host-env.md:31

Hidden file access

或写入宿主的 `.env` 文件:`~/.openclaw/.env`(macOS/Linux)/ `%USERPROFILE%\.openclaw\.env`(Windows)。

The documentation recommends storing or injecting the API key in host or sandbox configuration. This can persist secrets and broaden exposure if the configuration is shared.

Medium

SKILL.md:57

Ruby/shell backtick execution

- **npm/npx:** `npx --yes --package rollinggo@latest rollinggo ...`

This instruction causes the agent or user to run RollingGo through npm, uv, or the installed CLI. Running third-party CLI code is intended, but it is a real external command execution path.

Medium

SKILL.md:58

Ruby/shell backtick execution

- **uvx:** `uvx --refresh --from rollinggo@latest rollinggo ...`

This instruction causes the agent or user to run RollingGo through npm, uv, or the installed CLI. Running third-party CLI code is intended, but it is a real external command execution path.

Medium

SKILL.md:62

Ruby/shell backtick execution

- **npm 全局:** `npm install -g rollinggo@latest`

This instruction causes the agent or user to run RollingGo through npm, uv, or the installed CLI. Running third-party CLI code is intended, but it is a real external command execution path.

Medium

SKILL.md:63

Ruby/shell backtick execution

- **uv 工具:** `uv tool upgrade rollinggo@latest`

This instruction causes the agent or user to run RollingGo through npm, uv, or the installed CLI. Running third-party CLI code is intended, but it is a real external command execution path.

Medium

SKILL.md:70

Ruby/shell backtick execution

2. 如果需要标签筛选 → 先执行 `hotel-tags` 获取有效标签字符串

This instruction causes the agent or user to run RollingGo through npm, uv, or the installed CLI. Running third-party CLI code is intended, but it is a real external command execution path.

Medium

SKILL.md:71

Ruby/shell backtick execution

3. 执行 `search-hotels` → 解析 JSON → 提取 `hotelId`

This instruction causes the agent or user to run RollingGo through npm, uv, or the installed CLI. Running third-party CLI code is intended, but it is a real external command execution path.

Medium

SKILL.md:72

Ruby/shell backtick execution

4. 执行 `hotel-detail --hotel-id <id>` 查询房型和价格

This instruction causes the agent or user to run RollingGo through npm, uv, or the installed CLI. Running third-party CLI code is intended, but it is a real external command execution path.

Medium

SKILL.md:77-97

Ruby/shell backtick execution

```bash

This instruction causes the agent or user to run RollingGo through npm, uv, or the installed CLI. Running third-party CLI code is intended, but it is a real external command execution path.

Medium

SKILL.md:101

Ruby/shell backtick execution

- `--place-type` 必须使用 `rollinggo search-hotels --help` 里显示的精确值

This instruction causes the agent or user to run RollingGo through npm, uv, or the installed CLI. Running third-party CLI code is intended, but it is a real external command execution path.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (5)

RISK-001 High

references/claw-host-env.md:31

Environment file access

或写入宿主的 `.env` 文件:`~/.openclaw/.env`(macOS/Linux)/ `%USERPROFILE%\.openclaw\.env`(Windows)。

The documentation recommends storing or injecting the API key in host or sandbox configuration. This can persist secrets and broaden exposure if the configuration is shared.

RISK-002 High

references/claw-host-env.md:44

Environment file access

宿主 env 配置**不会**自动传入 sandbox 进程。需在 sandbox 内直接注入 `RollingGo_API_KEY`:`agents.defaults.sandbox.docker.

The documentation recommends storing or injecting the API key in host or sandbox configuration. This can persist secrets and broaden exposure if the configuration is shared.

RISK-003 High

SKILL.md:55-63 references/rollinggo-npx.md:53-63 references/rollinggo-uv.md:52-64

Mutable Latest Package Execution

The skill instructs agents to run rollinggo@latest through npx or uvx and to upgrade installed tools before use. A future package release could change executed code without marketplace review.

The instructions explicitly prefer @latest and refresh or upgrade behavior in multiple files. This is a clear supply-chain risk even though it supports freshness.

RISK-004 Medium

references/rollinggo-npx.md:78-79 references/rollinggo-npx.md:143-145 references/rollinggo-uv.md:79-80 references/rollinggo-uv.md:145-146

API Key In Command-Line Arguments

The reference docs show using --api-key with placeholder secrets. Real API keys passed this way may be exposed through shell history, process listings, or logs.

The documentation repeatedly presents --api-key usage. The values are placeholders, but the recommended pattern creates a common secret exposure channel.

RISK-005 Medium

references/claw-host-env.md:25-32 references/claw-host-env.md:42-44

Broad Host Secret Injection Guidance

The host environment reference allows API key injection at host and sandbox configuration levels. Shared scopes can expose the same credential to more skills or containers than needed.

The file directly documents host-level and sandbox-level environment injection. The risk depends on host configuration, but the broad-scope guidance is explicit.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

FIX-001
High
Unpinned third-party CLI execution

Pin RollingGo package versions or checksums in examples, and publish an audited upgrade process instead of defaulting to @latest.
FIX-002
Medium
API keys shown in command-line arguments

Prefer per-skill environment secret injection or a secret manager. Remove --api-key examples or warn that command-line secrets can be logged.
FIX-003
Medium
Broad host and sandbox credential scope

Recommend per-skill secret scope as the default and clearly discourage host-wide or container-wide API key injection unless required.
FIX-004
Medium
External command execution by an AI agent

Require explicit user confirmation before installing, upgrading, or running RollingGo, especially when network access and credentials are involved.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit: 62e2a730c5cd74eab4c7164309d810de660fcea3
Content hash: 42f95d25f7a16bf091d5bca9fa20bc88614220e2cf3e7517db3693a53649027c
Tree hash: 9833f442a66317b67ac66f391dfe36875602f6c49eec26706fe835701332092f
Skill path: skills/rollinggo-ai/rollinggo-searchhotel
Audit payload hash: 28bc7b5410e6a52a4cf813dd540bc5e7

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable