The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on the rgh CLI tool to perform its primary functions: logging in, searching for hotels, viewing details, confirming prices, and creating bookings. This is the intended behavior for an AI agent skill designed to interface with a local CLI.
[EXTERNAL_DOWNLOADS]: The skill instructions and metadata suggest installing the @rollinggo/hotel package via npm and referencing the author's GitHub repository. Since these resources belong to the official vendor (RollingGo-AI), this is considered standard and safe installation behavior.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data (hotel names, amenities, and descriptions) retrieved via the rgh tool. While this represents a theoretical ingestion point for malicious instructions from third-party hotel content, the skill effectively mitigates this risk by requiring explicit two-step user confirmation before performing any sensitive actions like booking or payment.
[DATA_EXPOSURE]: The skill collects necessary booking information (first name, last name, and email) only during the final booking step. This data is passed directly to the vendor's CLI for the intended transaction. The skill follows best practices by not hardcoding credentials and using a standard authorization flow.

rollinggo-hotel