Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for luckystarry/tc-chengxin.
Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Tongcheng Chengxin Travel Search" (luckystarry/tc-chengxin) from ClawHub.
Skill page: https://clawhub.ai/luckystarry/tc-chengxin
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required binaries: node
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.
Command Line
CLI Commands
Use the direct CLI path if you want to install manually and keep every step visible.
OpenClaw CLI
Bare skill slug
openclaw skills install tc-chengxin
ClawHub CLI
Package manager switcher
npx clawhub@latest install tc-chengxin
Security Scan
Capability signals
Requires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
Name/description (online travel search: flights, trains, hotels, buses, scenery, trip planning) matches the shipped files: per-intent CLI scripts, shared query runner, formatters and helpers. Required binary (node) and primaryEnv (CHENGXIN_API_KEY) are coherent with a Node-based HTTP client to an upstream Chengxin service.
✓
Instruction Scope
SKILL.md and the scripts limit behaviour to parsing user query parameters, building request payloads and formatting responses from the Chengxin API. The instructions explicitly require channel/surface and passing user modifiers via --extra. There are no instructions to read unrelated system files or to exfiltrate environment data beyond the declared API key. The library functions sanitize inputs and truncate long fields.
✓
Install Mechanism
There is no install spec (no network downloads or package installers defined); the skill is Node script-based and expects an existing node binary. That is low-risk. Note: code files are present and will run under node when invoked — there is no automatic installer, but the scripts will execute if the agent runs them.
ℹ
Credentials
The skill declares a single primary credential CHENGXIN_API_KEY which is appropriate for a search API. SKILL.md marks CHENGXIN_API_KEY as optional (trial mode possible). Recommend confirming what permissions the API key grants before use. I could not review api-client.js content in the provided excerpt; verify that it only sends requests to trusted Chengxin/ly.com endpoints and does not transmit additional environment variables or local data.
✓
Persistence & Privilege
Flags are standard: always:false (no forced global enable). disable-model-invocation is false (agent can invoke autonomously), which is the platform default and expected for an integrative skill. The skill does not request system-wide config paths or elevated privileges in the provided code.
Assessment
This skill appears coherent for a Chengxin/同程 travel search: it is Node-based and asks only for CHENGXIN_API_KEY. Before installing or supplying a real API key: 1) Review scripts/lib/api-client.js to confirm the exact endpoints and that requests go to the official Chengxin/ly.com service and that no extra local data or other env vars are sent. 2) If possible, use a scoped/test API key with limited quota and monitor its usage. 3) Remember these files will be executed by node; run them in a sandbox or test environment first. 4) If you plan to allow autonomous invocation, be aware the agent can call this skill without prompting — that’s normal but increases the blast radius if the API key is compromised. If you want, share the api-client.js contents and I will re-check the network targets and any unexpected transmission of data.
Like a lobster shell, security has layers — review code before you run it.
Runtime requirements
Binsnode
Primary envCHENGXIN_API_KEY
Environment variables
CHENGXIN_API_KEYoptional— 同程程心 API Key（未配置时可使用试用额度，超出后需申领激活码）
