技能 rollinggo-searchhotel
📦

rollinggo-searchhotel

内容修订 r1 高风险 📁 文件系统访问🔑 环境变量⚙️ 外部命令🌐 网络访问

使用 RollingGo 搜索酒店

酒店搜索通常需要当前价格、标签和房间详情。此技能使用 RollingGo CLI 查找酒店并比较结构化结果。

支持: Claude Codex Code(CC)
⚠️ 38 差

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求
Review the Skillstore skill "rollinggo-searchhotel" from https://skillstore.io/skills/rollinggo-ai-rollinggo-searchhotel.md and its manifest at https://skillstore.io/api/skills/rollinggo-ai-rollinggo-searchhotel/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/rollinggo-ai-rollinggo-searchhotel.md 已签名 manifest GET /api/skills/rollinggo-ai-rollinggo-searchhotel/manifest 已签名 lockfile GET /api/skills/rollinggo-ai-rollinggo-searchhotel/lockfile

测试它

正在使用“rollinggo-searchhotel”。 查找四月初 Tokyo Disney 附近适合两位成人入住的酒店。

预期结果:

一份排序后的候选清单，包含酒店名称、每晚价格、星级、距离和可用预订链接。

正在使用“rollinggo-searchhotel”。 比较所选酒店 ID 的详情。

预期结果:

对房型、总入住价格、退款条款以及选择每个选项的理由进行简明比较。

正在使用“rollinggo-searchhotel”。 查找 Shanghai Disney 附近含早餐的家庭友好酒店。

预期结果:

使用有效 RollingGo 标签筛选出的列表，并附有关于预算匹配度和距目的地距离的说明。

安全审计

高风险
v4 • 2026/7/5 打开版本化报告

The skill is not overtly malicious and I found no prompt injection attempt. It does handle a RollingGo API key and directs users to run mutable third-party CLI packages, so the main risks are credential exposure and supply-chain drift.

4
已扫描文件
584
分析行数
32
复核项
0
已忽略误报

已确认安全问题 (5)

高
references/claw-host-env.md:31
Environment file access
或写入宿主的 `.env` 文件:`~/.openclaw/.env`(macOS/Linux)/ `%USERPROFILE%\.openclaw\.env`(Windows)。
The documentation recommends storing or injecting the API key in host or sandbox configuration. This can persist secrets and broaden exposure if the configuration is shared.
高
references/claw-host-env.md:44
Environment file access
宿主 env 配置**不会**自动传入 sandbox 进程。需在 sandbox 内直接注入 `RollingGo_API_KEY`:`agents.defaults.sandbox.docker.
The documentation recommends storing or injecting the API key in host or sandbox configuration. This can persist secrets and broaden exposure if the configuration is shared.
高
SKILL.md:55-63references/rollinggo-npx.md:53-63references/rollinggo-uv.md:52-64
Mutable Latest Package Execution
The skill instructs agents to run rollinggo@latest through npx or uvx and to upgrade installed tools before use. A future package release could change executed code without marketplace review.
The instructions explicitly prefer @latest and refresh or upgrade behavior in multiple files. This is a clear supply-chain risk even though it supports freshness.
中
references/rollinggo-npx.md:78-79references/rollinggo-npx.md:143-145references/rollinggo-uv.md:79-80references/rollinggo-uv.md:145-146
API Key In Command-Line Arguments
The reference docs show using --api-key with placeholder secrets. Real API keys passed this way may be exposed through shell history, process listings, or logs.
The documentation repeatedly presents --api-key usage. The values are placeholders, but the recommended pattern creates a common secret exposure channel.
中
references/claw-host-env.md:25-32references/claw-host-env.md:42-44
Broad Host Secret Injection Guidance
The host environment reference allows API key injection at host and sandbox configuration levels. Shared scopes can expose the same credential to more skills or containers than needed.
The file directly documents host-level and sandbox-level environment injection. The risk depends on host configuration, but the broad-scope guidance is explicit.
能力复核项 (32)

这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。

高
references/claw-host-env.md:31
Hidden file in home directory
或写入宿主的 `.env` 文件:`~/.openclaw/.env`(macOS/Linux)/ `%USERPROFILE%\.openclaw\.env`(Windows)。
The documentation recommends storing or injecting the API key in host or sandbox configuration. This can persist secrets and broaden exposure if the configuration is shared.
高
references/claw-host-env.md:3
Generic API/secret keys
本技能需要在进程里能读到 `RollingGo_API_KEY`。如果宿主在不同 run 间丢失该变量,请使用宿主级注入而非 shell export。
The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.
高
references/claw-host-env.md:18
Generic API/secret keys
"env": { "RollingGo_API_KEY": "YOUR_KEY" }
The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.
高
references/claw-host-env.md:28
Generic API/secret keys
{ "env": { "RollingGo_API_KEY": "YOUR_KEY" } }
The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.
高
references/claw-host-env.md:44
Generic API/secret keys
宿主 env 配置**不会**自动传入 sandbox 进程。需在 sandbox 内直接注入 `RollingGo_API_KEY`:`agents.defaults.sandbox.docker.
The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.
高
references/rollinggo-npx.md:69
Generic API/secret keys
解析顺序:`--api-key` 参数 → `RollingGo_API_KEY` 环境变量。
The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.
高
references/rollinggo-npx.md:73
Generic API/secret keys
export RollingGo_API_KEY="YOUR_API_KEY"
The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.
高
references/rollinggo-npx.md:76
Generic API/secret keys
$env:RollingGo_API_KEY="YOUR_API_KEY"
The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.
高
references/rollinggo-npx.md:79
Generic API/secret keys
rollinggo hotel-tags --api-key YOUR_API_KEY
This line documents passing an API key on the command line, which can expose secrets through shell history or process listings. The example uses placeholders, but the usage pattern is real.
高
references/rollinggo-npx.md:82
Generic API/secret keys
宿主经常丢失 `RollingGo_API_KEY` 时,见 [claw-host-env.md](claw-host-env.md)。
The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.
高
references/rollinggo-npx.md:145
Generic API/secret keys
rollinggo hotel-tags --api-key YOUR_API_KEY
This line documents passing an API key on the command line, which can expose secrets through shell history or process listings. The example uses placeholders, but the usage pattern is real.
高
references/rollinggo-npx.md:188
Generic API/secret keys
- **缺少 API Key 报错:** 传入 `--api-key`、设置 `RollingGo_API_KEY`,或者如果你跑在任何 claw 风格宿主里,就按 [claw-host-env.md
The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.
高
references/rollinggo-uv.md:70
Generic API/secret keys
解析顺序:`--api-key` 参数 → `RollingGo_API_KEY` 环境变量。
The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.
高
references/rollinggo-uv.md:74
Generic API/secret keys
export RollingGo_API_KEY="YOUR_API_KEY"
The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.
高
references/rollinggo-uv.md:77
Generic API/secret keys
$env:RollingGo_API_KEY="YOUR_API_KEY"
The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.
高
references/rollinggo-uv.md:80
Generic API/secret keys
rollinggo hotel-tags --api-key YOUR_API_KEY
This line documents passing an API key on the command line, which can expose secrets through shell history or process listings. The example uses placeholders, but the usage pattern is real.
高
references/rollinggo-uv.md:83
Generic API/secret keys
宿主经常丢失 `RollingGo_API_KEY` 时,见 [claw-host-env.md](claw-host-env.md)。
The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.
高
references/rollinggo-uv.md:146
Generic API/secret keys
rollinggo hotel-tags --api-key YOUR_API_KEY
This line documents passing an API key on the command line, which can expose secrets through shell history or process listings. The example uses placeholders, but the usage pattern is real.
高
references/rollinggo-uv.md:192
Generic API/secret keys
- **缺少 API Key 报错:** 传入 `--api-key`、设置 `RollingGo_API_KEY`,或者如果你跑在任何 claw 风格宿主里,就按 [claw-host-env.md
The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.
高
SKILL.md:10
Generic API/secret keys
"primaryEnv": "RollingGo_API_KEY",
The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.
高
SKILL.md:13
Generic API/secret keys
"env": ["RollingGo_API_KEY"]
The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.
高
SKILL.md:45
Generic API/secret keys
解析顺序:`--api-key` 参数 → `RollingGo_API_KEY` 环境变量。
The skill intentionally uses RollingGo_API_KEY as a credential for a third-party CLI and API. This is expected behavior, but it is real secret handling in the user environment.
中
references/claw-host-env.md:31
Hidden file access
或写入宿主的 `.env` 文件:`~/.openclaw/.env`(macOS/Linux)/ `%USERPROFILE%\.openclaw\.env`(Windows)。
The documentation recommends storing or injecting the API key in host or sandbox configuration. This can persist secrets and broaden exposure if the configuration is shared.
中
SKILL.md:57
Ruby/shell backtick execution
- **npm/npx:** `npx --yes --package rollinggo@latest rollinggo ...`
This instruction causes the agent or user to run RollingGo through npm, uv, or the installed CLI. Running third-party CLI code is intended, but it is a real external command execution path.
中
SKILL.md:58
Ruby/shell backtick execution
- **uvx:** `uvx --refresh --from rollinggo@latest rollinggo ...`
This instruction causes the agent or user to run RollingGo through npm, uv, or the installed CLI. Running third-party CLI code is intended, but it is a real external command execution path.
中
SKILL.md:62
Ruby/shell backtick execution
- **npm 全局:** `npm install -g rollinggo@latest`
This instruction causes the agent or user to run RollingGo through npm, uv, or the installed CLI. Running third-party CLI code is intended, but it is a real external command execution path.
中
SKILL.md:63
Ruby/shell backtick execution
- **uv 工具:** `uv tool upgrade rollinggo@latest`
This instruction causes the agent or user to run RollingGo through npm, uv, or the installed CLI. Running third-party CLI code is intended, but it is a real external command execution path.
中
SKILL.md:70
Ruby/shell backtick execution
2. 如果需要标签筛选 → 先执行 `hotel-tags` 获取有效标签字符串
This instruction causes the agent or user to run RollingGo through npm, uv, or the installed CLI. Running third-party CLI code is intended, but it is a real external command execution path.
中
SKILL.md:71
Ruby/shell backtick execution
3. 执行 `search-hotels` → 解析 JSON → 提取 `hotelId`
This instruction causes the agent or user to run RollingGo through npm, uv, or the installed CLI. Running third-party CLI code is intended, but it is a real external command execution path.
中
SKILL.md:72
Ruby/shell backtick execution
4. 执行 `hotel-detail --hotel-id <id>` 查询房型和价格
This instruction causes the agent or user to run RollingGo through npm, uv, or the installed CLI. Running third-party CLI code is intended, but it is a real external command execution path.
中
SKILL.md:77-97
Ruby/shell backtick execution
```bash
This instruction causes the agent or user to run RollingGo through npm, uv, or the installed CLI. Running third-party CLI code is intended, but it is a real external command execution path.
中
SKILL.md:101
Ruby/shell backtick execution
- `--place-type` 必须使用 `rollinggo search-hotels --help` 里显示的精确值
This instruction causes the agent or user to run RollingGo through npm, uv, or the installed CLI. Running third-party CLI code is intended, but it is a real external command execution path.

风险因素

📁 文件系统访问 (2)
references/claw-host-env.md:31 references/claw-host-env.md:31
🔑 环境变量 (21)
references/claw-host-env.md:3 references/claw-host-env.md:18 references/claw-host-env.md:28 references/claw-host-env.md:44 references/rollinggo-npx.md:69 references/rollinggo-npx.md:73 references/rollinggo-npx.md:76 references/rollinggo-npx.md:79 references/rollinggo-npx.md:82 references/rollinggo-npx.md:145 references/rollinggo-npx.md:188 references/rollinggo-uv.md:70 references/rollinggo-uv.md:74 references/rollinggo-uv.md:77 references/rollinggo-uv.md:80 references/rollinggo-uv.md:83 references/rollinggo-uv.md:146 references/rollinggo-uv.md:192 SKILL.md:10 SKILL.md:13 SKILL.md:45
⚙️ 外部命令 (21)
references/rollinggo-npx.md:75 references/rollinggo-uv.md:76 SKILL.md:45 SKILL.md:51 SKILL.md:57 SKILL.md:58 SKILL.md:62 SKILL.md:63 SKILL.md:70 SKILL.md:71 SKILL.md:72 SKILL.md:77-97 SKILL.md:97-101 SKILL.md:101 SKILL.md:102 SKILL.md:103 SKILL.md:104 SKILL.md:105 SKILL.md:106 SKILL.md:112 SKILL.md:117
🌐 网络访问 (2)
SKILL.md:4 SKILL.md:47
审计者: codex 查看审计历史 →
分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告
安全评估

复制报告链接

https://skillstore.io/skills/rollinggo-ai-rollinggo-searchhotel/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/rollinggo-ai-rollinggo-searchhotel/security.svg)](https://skillstore.io/skills/rollinggo-ai-rollinggo-searchhotel?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/rollinggo-ai-rollinggo-searchhotel?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/rollinggo-ai-rollinggo-searchhotel/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/rollinggo-ai-rollinggo-searchhotel.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
学术引用 (APA · BibTeX · CFF)

APA 引用

RollingGo-AI. (2026). rollinggo-searchhotel security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/rollinggo-ai-rollinggo-searchhotel/audits/4

BibTeX 引用

@techreport{rollinggo-ai-rollinggo-ai-rollinggo-searchhotel-2026, author = {RollingGo-AI}, title = {rollinggo-searchhotel security audit report (audit version 4)}, institution = {Skillstore}, year = {2026}, number = {4}, url = {https://skillstore.io/skills/rollinggo-ai-rollinggo-searchhotel/audits/4}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "rollinggo-searchhotel security audit report (audit version 4)" version: "unspecified" type: report authors: - name: "RollingGo-AI" date-released: "2026-07-05" url: "https://skillstore.io/skills/rollinggo-ai-rollinggo-searchhotel/audits/4" identifiers: - type: other value: "skillstore:rollinggo-ai-rollinggo-searchhotel:audit:4" description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据 证据置信度: 中
45
架构
85
可维护性
87
内容
68
社区
91
规范符合性

你能构建什么

查找景点附近的家庭酒店

使用日期、住客人数、预算和家庭友好标签搜索地标附近的酒店。

预订前比较房间价格

在分享预订链接前，获取所选酒店 ID 的酒店详情和房间价格。

构建筛选后的酒店候选清单

使用标签、品牌、距离和星级为行程创建聚焦的候选清单。

试试这些提示

基础酒店搜索 
搜索 2026 年 4 月 1 日至 4 月 3 日期间，Tokyo Disney Resort 附近适合两位成人入住的酒店。显示五个不错的选择。
预算和星级筛选 
查找 Shanghai Disney 附近每晚低于 800 CNY、入住两晚的酒店。将结果限制为四星和五星酒店。
基于标签的家庭搜索 
获取可用的酒店标签，然后搜索 Tokyo Disney 附近适合家庭且包含早餐的酒店。
详细酒店比较 
搜索 Shanghai 的 the Bund 附近三家酒店，查看每个酒店 ID 的房间详情，并比较价格、房型和取消政策。

最佳实践

  • 搜索前确认目的地、日期、住客、房间数和预算。
  • 请求房间详情时使用搜索结果中的酒店 ID。
  • 将 RollingGo API 密钥存储在限定范围的密钥配置中。

避免

  • 不要将此技能用于航班、火车、接送或租车。
  • 不要在提示或可见命令文本中直接传递真实 API 密钥。
  • 当酒店 ID 可用时，不要依赖酒店名称。

常见问题

此技能搜索什么？
它通过 RollingGo CLI 搜索酒店，并可以检索酒店详情、标签、房间价格和预订链接。
它需要 API 密钥吗？
是。RollingGo CLI 需要通过限定范围的环境变量或其他支持的密钥来源提供 RollingGo API 密钥。
它可以完成预订吗？
不能。它可以返回预订 URL 或酒店详情链接，但用户需要在技能之外完成付款。
它可以按酒店标签筛选吗？
可以。它可以获取有效标签，并将其用作偏好、必需或排除的酒店筛选条件。
哪些 AI 工具可以使用它？
报告列出了对 Claude、Codex 和 Claude Code 的支持。
用户在预订前应核实什么？
用户应核实价格、日期、房型、取消政策、税费、费用和预订网站条款。

开发者详情

许可证

MIT

Skillstore 修订

r1

版本提示

作者未声明版本。

仓库

https://github.com/RollingGo-AI/rollinggo-skills/tree/main/rollinggo-hotel-cn/

引用

62e2a730c5cd74eab4c7164309d810de660fcea3

维护新鲜度

2026/7/20

使用量

2 次下载 · 67 次浏览

文件结构

📁 references/

📄 claw-host-env.md

📄 rollinggo-npx.md

📄 rollinggo-uv.md

📄 SKILL.md

RollingGo-AI 的更多技能

查看全部

相关技能

查看全部