skills/rollinggo-ai/rollinggo-hotel-price-monitor-skill/rollinggo-hotel-price-monitor/Gen Agent Trust Hub
rollinggo-hotel-price-monitor
Warn
Audited by Gen Agent Trust Hub on Jun 6, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use the
rollinggoCLI tool by constructing shell commands that include user-provided parameters like hotel names, cities, and dates as command-line flags. Without explicit requirements for input sanitization or shell-safe quoting, this pattern is susceptible to command injection if an attacker provides malicious input. - [EXTERNAL_DOWNLOADS]: The skill configuration in
SKILL.mdand the reference guides (rollinggo-npx.md,rollinggo-uv.md) mandate the installation of therollinggopackage from NPM or PyPI at runtime. It specifically requests thelatestversion, which introduces a supply chain risk as the executed code is not pinned to a known-safe version and can change between executions.
Audit Metadata