hotel-price-monitor
Pass
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the rgh CLI tool during installation from the author's GitHub repository (RollingGo-AI/oauth-hotel-cli) or via npm (@rollinggo/hotel). These downloads are necessary for the skill's operations.\n- [COMMAND_EXECUTION]: The install script in scripts/install.py uses the subprocess module to check for Node.js/npm availability and to execute installation commands. The commands are hardcoded to the vendor's package and do not accept unsanitized user input.\n- [REMOTE_CODE_EXECUTION]: The skill downloads and executes a platform-specific binary (rgh) to retrieve hotel data and manage bookings. This code is sourced directly from the RollingGo-AI organization on GitHub.\n- [PROMPT_INJECTION]: The skill contains instructions for the agent to fetch a remote SKILL.md file from GitHub to check for updates. While this involves processing external content, it is a standard maintenance practice and uses a specific, hardcoded path to the author's repository.
Audit Metadata