Travel Concierge CLI
v1.0.1Find contact details for accommodation listings (Airbnb, Booking.com, VRBO, Expedia)
⭐ 1· 2.4k·6 current·7 all-time
by@arein
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The name and description (find contact details for accommodation listings) line up with the instructions (scrape listing pages and optionally use Google Places). However, the SKILL.md assumes the existence of a 'travel-concierge' CLI but the package contains no CLI binary, no source code implementing that CLI, and no install instructions — only a test config file. This is an operational inconsistency (likely an instruction-only skill that expects an external tool), not evidence of malicious intent.
Instruction Scope
Runtime instructions are narrowly scoped: they tell the agent to run the CLI against a provided URL, present found contact methods, and optionally configure a Google Places API key. The doc mentions browser automation (agent-browser) for JS-rendered pages, but does not instruct reading unrelated local files, environment variables, or transmitting data to unknown endpoints. The agent would perform web scraping of publicly available pages, which is within the stated purpose.
Install Mechanism
No install spec is present (lowest risk). The only included code file is a harmless vitest config with no application source. The notable issue is absence of the claimed CLI implementation or an install method — meaning the skill as packaged likely cannot actually run the described commands without external software.
Credentials
The skill declares no required environment variables or credentials. SKILL.md describes an optional Google Places API key (configured via the CLI), which is reasonable and optional. There are no requests for unrelated secrets or system config paths.
Persistence & Privilege
The skill does not request always:true or elevated persistence. It is user-invocable and allows autonomous model invocation by default (platform normal). There is no indication it modifies other skills or system-wide settings.
Assessment
This skill's purpose and instructions are coherent and it does not request credentials, but the package does not include the 'travel-concierge' CLI or any install steps — it may be an instruction-only wrapper that expects you to already have that tool installed. Before installing/using: (1) verify where the CLI comes from and obtain it from a trusted source if needed; (2) avoid entering API keys (e.g., Google Places) unless you trust the CLI/vendor; (3) be aware web scraping may violate platform terms of service; and (4) monitor network activity if you run any third-party CLI to ensure it doesn't exfiltrate data.Like a lobster shell, security has layers — review code before you run it.
latestvk97f85694henpvmc1vrxnbmqvn7zzp6p
License
MIT-0
Free to use, modify, and redistribute. No attribution required.