AI机票预订助手

for passenger in passenger_list:
        product_id = passenger.get("productId", "")
        if product_id:
            product_id_list.append(product_id)
...
product_ids = ",".join(product_id_list)
...
response = refund_apply(order_id, product_ids, refund_amount)

The refund script gathers all passenger ticket product IDs from an order and submits a refund request once invoked, without an in-script final confirmation or passenger-level scoping.

print(f"乘客姓名: {passenger_name}")
print(f"乘客手机号: {passenger_phone}")
print(f"乘客证件号: {passenger_id}")

The script prints full passenger PII to stdout during order creation, despite the skill documentation telling users not to expose personal information in logs or replies.

def get_auth_file_path():
    # 使用临时目录下的文件（避免权限问题）
    return get_temp_file_path(".fbt_auth.json")
...
"apiKey": api_key,
"phone": phone,
"auth_time": datetime.now().isoformat(),
"expire_days": 90

A reusable account apiKey and phone number are persisted for 90 days in a temporary-directory file, and later calls automatically load and use that apiKey.

return os.environ.get("FBT_API_URL", "https://app-gate.fenbeitong.com/air_biz/skill/execute")
...
context = ssl._create_unverified_context()
with urllib.request.urlopen(req, context=context) as response:

All API calls can be redirected by an undeclared environment variable and are made with certificate verification disabled, while the payloads include apiKey and booking/PII data.

seat_items_file = get_temp_file_path("flight_seat_items.json")
...
for item in seat_items:
    if item.get("display_index") == seat_index_int:
        seat_item = item
        break

Order creation trusts a generic temporary file of prior seat results and maps the user's selected number to that stored data, without binding it to a session, user, route, or order.