rollinggo-hotel-booking

该技能的酒店搜索和预订流程与声明用途基本一致，数据主要流向 RollingGo 自有域名，没有明显第三方中转窃取迹象，因此不像明确恶意技能。但它允许并鼓励通过未固定版本、未见签名校验的独立二进制安装 CLI，而该 CLI 会接收 OAuth 登录状态、订单信息及用户姓名邮箱等敏感数据；这使其整体更适合归类为 SUSPICIOUS / 高风险供应链技能，而非 BENIGN。

No direct malware behaviors (e.g., exfiltration, backdoor installation, eval-based execution) are present in this fragment. However, it performs high-risk supply-chain actions: installs a global npm package using an unpinned '@latest' version (which may trigger install lifecycle scripts) and downloads a remote executable binary from GitHub Releases without any integrity verification, then marks it executable. These patterns warrant security review, pinning, and artifact verification.