hotel-booking-timing
Pass
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands to perform its core functions, including using
curlfor API requests andnode -eto run a static script that parses the resulting JSON-RPC data stream. It also uses thedatecommand to resolve relative timeframes provided by the user. - [EXTERNAL_DOWNLOADS]: The skill communicates with
besttimetobookhotels.comto fetch hotel pricing information and booking verdicts. This communication is directed to the service's primary API endpoint and is a transparent part of the skill's operation. - [PROMPT_INJECTION]: There is an indirect prompt injection surface because the skill processes and displays external data from a remote API.
- Ingestion points: The body of the HTTP response from
besttimetobookhotels.com. - Boundary markers: None are present; the skill's instructions explicitly tell the agent to relay the returned markdown verbatim to the user.
- Capability inventory: The skill uses
curlandnodefor data retrieval and parsing. - Sanitization: None is implemented; the skill relies on the remote API to provide safe, pre-formatted markdown text.
Audit Metadata