hotel-all-in-one
Fail
Audited by Snyk on Jul 3, 2026
Risk Level: CRITICAL
Full Analysis
CRITICAL E005: Suspicious download URL detected in skill instructions.
- Suspicious download URL detected (high risk: 0.95). These are direct downloads of platform binaries (.exe / macos / linux) from a small/unknown GitHub repository (RollingGo-AI) and the provided install script instructs executing and auto-updating an untrusted CLI — a common malware distribution pattern, so treat as high risk.
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 1.00). The included installer script (scripts/install.py) queries the GitHub API (https://api.github.com/repos/RollingGo-AI/oauth-hotel-cli-overseas/releases/latest) and downloads executables from the repository release URLs (e.g., https://github.com/RollingGo-AI/oauth-hotel-cli-overseas/releases/latest/download/rgg-linux and OS variants) at install/runtime, which fetches and supplies executable code the skill relies on and will run—constituting a runtime external dependency that executes remote code.
Issues (2)
E005
CRITICALSuspicious download URL detected in skill instructions.
W012
MEDIUMUnverifiable external dependency detected (runtime URL that controls agent).
Audit Metadata