hotel-booking-timing

Pass

Audited by Gen Agent Trust Hub on Jul 20, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes shell commands to perform its core functions, including using curl for API requests and node -e to run a static script that parses the resulting JSON-RPC data stream. It also uses the date command to resolve relative timeframes provided by the user.
  • [EXTERNAL_DOWNLOADS]: The skill communicates with besttimetobookhotels.com to fetch hotel pricing information and booking verdicts. This communication is directed to the service's primary API endpoint and is a transparent part of the skill's operation.
  • [PROMPT_INJECTION]: There is an indirect prompt injection surface because the skill processes and displays external data from a remote API.
  • Ingestion points: The body of the HTTP response from besttimetobookhotels.com.
  • Boundary markers: None are present; the skill's instructions explicitly tell the agent to relay the returned markdown verbatim to the user.
  • Capability inventory: The skill uses curl and node for data retrieval and parsing.
  • Sanitization: None is implemented; the skill relies on the remote API to provide safe, pre-formatted markdown text.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 20, 2026, 08:58 AM
Security Audit — agent-trust-hub — hotel-booking-timing