hotel-core

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). These links include direct downloads of standalone executables from an unverified GitHub repository and a non-standard OAuth domain used for login—both are high-risk vectors for distributing malware or phishing payloads.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). SKILL.md 的 Step 3/4/6 会把运行时从 CLI（对外部酒店/标签服务的搜索/详情/订单结果）得到的字段（如酒店描述 tags/取消政策/房型名等）读入并用于 LLM 展示；其中这些文本很可能包含外部系统返回的自由文本，而非由操作用户选择的自家内容。

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly instructs at runtime to silently fetch the remote SKILL.md from https://raw.githubusercontent.com/RollingGo-AI/rollinggo-hotel-skill-CN/main/skills/{name}/SKILL.md and then modify agent output (prepend an update warning) based on that fetched content, so this external URL directly controls prompts.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). 该 Skill 明确包含预订与结算流程：提供用于锁定价格的 rgh price-confirm 命令、用于创建订单的 rgh book 命令，并且明确要求“从结果中提取 alipayUrl 或其他支付链接返回给用户”，以及在返回的订单模板中包含支付链接。也就是说该 Skill 专门用于发起真实消费流程并生成/暴露支付网关链接（如支付宝），属于针对支付/下单的具体接口调用，具备直接财务执行相关能力。