Skills
Navigate
skills/rollinggo-ai/rollinggo-hotel-skill-cn/hotel-all-in-one/Gen Agent Trust Hub

hotel-all-in-one

Pass

Audited by Gen Agent Trust Hub on Jul 9, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The scripts/install.py script downloads platform-specific binary executables (rgh-win.exe, rgh-macos, rgh-linux) from the author's official GitHub repository at RollingGo-AI/oauth-hotel-cli.
  • [COMMAND_EXECUTION]: The installation script utilizes the subprocess module to detect local Node.js environments and attempt package installation via npm.
  • [COMMAND_EXECUTION]: The SKILL.md file instructs the agent to execute various rgh CLI commands (e.g., search-hotels, hotel-detail, book) to fulfill user requests.
  • [COMMAND_EXECUTION]: The scripts/install.py script programmatically modifies file permissions using os.chmod to ensure the downloaded binaries are executable on macOS and Linux platforms.
  • [PROMPT_INJECTION]: The skill includes a self-updating mechanism that asks the agent to fetch a remote version of the SKILL.md file from raw.githubusercontent.com and conditionally alter its response based on the version metadata found in the remote file.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 9, 2026, 04:24 PM
Security Audit — agent-trust-hub — hotel-all-in-one