Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

便捷旅行预订

v1.0.0

酒店聚合助手,整合分贝通、携程、美团、同程、华住会、锦江等多个酒店数据源,提供统一的酒店搜索、房型查询、预订服务。Invoke when user wants to search hotels across multiple platforms or aggregate hotel data from vario...

0· 86·0 current·0 all-time
by赵瑞宇@ryan-zry·duplicate of @ryan-zry/travel-smart-booking

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for ryan-zry/easy-travel-booking.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "便捷旅行预订" (ryan-zry/easy-travel-booking) from ClawHub.
Skill page: https://clawhub.ai/ryan-zry/easy-travel-booking
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required binaries: python3
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install easy-travel-booking

ClawHub CLI

Package manager switcher

npx clawhub@latest install easy-travel-booking
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The skill's name/description promise aggregation across many commercial platforms (携程, 美团, 分贝通, 同程, 华住会, 锦江). The code defines those data sources and base URLs, but the individual source search functions are TODO stubs (no real API calls implemented) and the skill declares no required environment variables or configuration mechanism for API keys/tokens. Aggregating real platform data would normally require credentials or scraping logic; the lack of any declared credentials/config path is disproportionate to the claimed capability.
Instruction Scope
SKILL.md instructs the agent to call each platform's APIs and forbids fabricating prices, which is appropriate conceptually. The instructions do not ask the agent to read unrelated system files or secrets. However, the SKILL.md demands 'must call platform APIs' but provides no guidance on where platform credentials/config are stored or how to authenticate, leaving broad implementation discretion.
Install Mechanism
No install spec is provided (instruction-only), which is lower risk. However, the package includes two Python scripts that would be executed at runtime; there is no install or setup guidance for dependencies beyond requiring python3. Including runnable code without an install step is not inherently malicious but increases the chance the skill will fail or behave unexpectedly in different environments.
!
Credentials
The skill requests no environment variables or primary credential, yet its intended function (calling multiple external OTA and group APIs) normally requires API keys, client secrets, or account-level credentials. The absence of declared credentials or config paths is an incoherence: either the skill is incomplete (placeholders) or it expects credentials to be supplied out-of-band (which should have been declared).
Persistence & Privilege
The skill is not flagged as always:true and does not request elevated/persistent privileges. It does not attempt to modify other skills or system-wide settings in the provided code. Autonomous invocation remains possible (platform default) but is not combined here with other high-risk factors.
What to consider before installing
This skill promises multi-platform hotel aggregation but the code contains TODO stubs for each platform and the package does not declare where API keys or credentials should be provided. Before installing or using it: (1) ask the author how/where platform credentials are configured and insist they be declared in requires.env or documented; (2) review the full aggregate_search/get_hotel_detail implementations (the provided snippet is incomplete) to confirm there are no hidden endpoints or unexpected data exfiltration; (3) run the code in a sandboxed environment and monitor network calls to verify it only contacts expected official APIs; (4) confirm you have legal permission / API agreements to query the named platforms; (5) if you must supply credentials, prefer creating least-privilege API keys and avoid reusing high-privilege account secrets. The current mismatch between claimed capabilities and required configuration is why I rate it suspicious.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🏨 Clawdis
Binspython3
latestvk97e4xzk65jgt6gb44ag3bytrd83w39f
86downloads
0stars
1versions
Updated 4w ago
v1.0.0
MIT-0

酒店聚合助手 (fb-hotel-aggregation-skill)

技能描述

酒店聚合助手,整合多个酒店数据源(分贝通、携程、美团、同程、华住会、锦江等),提供统一的酒店搜索、房型查询、价格对比、预订服务。通过数据标准化和智能聚合,为用户提供更全面、更优惠的酒店选择。


⚠️ 【重要约束】

  • 必须调用各平台API获取真实数据
  • 禁止自行编造酒店信息、价格或库存
  • 数据聚合时需标明数据来源
  • 接口返回什么数据就展示什么,不要修改

技能概述

基于多数据源聚合技术,实现:

  • 多平台酒店数据统一搜索
  • 数据标准化和去重合并
  • 智能排序和推荐
  • 统一预订流程

技能能力

核心能力

  1. 多源数据聚合:整合分贝通、携程、美团、同程、华住会、锦江等平台
  2. 统一搜索:一次搜索,返回所有平台的酒店结果
  3. 智能去重:相同酒店多平台数据合并展示
  4. 最优价格:自动筛选各平台最低价格
  5. 统一预订:支持选择任意平台进行预订

触发条件

  1. 聚合搜索:当用户搜索酒店时,同时查询多个平台

    • 返回聚合后的酒店列表
    • 显示各平台价格对比
    • 标注最优价格来源
  2. 展示格式示例

    🏨 北京三元桥附近酒店聚合结果(3月15日入住)
    
    | 序号 | 酒店名称 | 星级 | 区域 | 最优价格 | 价格来源 |
    |:---:|---------|:---:|------|---:|:---|
    | 1 | 桔子酒店(北京三元桥店) | 舒适型 | 朝阳区 | ¥483 | 携程 |
    | 2 | 魔方公寓(北京三元桥店) | 经济型 | 朝阳区 | ¥333 | 美团 |
    
    💡 回复"序号"查看房型详情
    💡 回复"序号-比价"查看该酒店各平台价格对比
    

数据源配置

支持的数据源

数据源标识类型特点
分贝通fenbeitongB2B企业协议价、商旅管理
携程ctripOTA库存丰富、价格优势
美团meituanOTA本地生活、优惠券多
同程tongchengOTA微信生态、返现活动
华住会huazhu集团直联会员权益、积分价值高
锦江jinjiang集团直联会员折扣、品牌多

核心接口列表

一、聚合搜索接口

接口名称核心用途必选参数
aggregate_search多平台酒店聚合搜索city, check_in, check_out, keywords
get_hotel_detail_aggregate聚合酒店详情hotel_id, source
get_room_prices_aggregate聚合房型价格hotel_id, check_in, check_out

二、数据管理接口

接口名称核心用途说明
sync_hotel_data同步酒店基础数据从各平台同步酒店信息
merge_duplicate_hotels合并重复酒店基于名称、地址匹配去重
refresh_prices刷新价格数据实时更新各平台价格

数据模型

统一酒店模型

{
  "hotel_id": "聚合ID",
  "name": "酒店名称",
  "name_en": "英文名称",
  "address": "地址",
  "city": "城市",
  "district": "区域",
  "star_level": "星级",
  "score": "评分",
  "images": ["图片URL"],
  "facilities": ["设施"],
  "sources": [
    {
      "platform": "平台标识",
      "external_id": "平台酒店ID",
      "price": "价格",
      "url": "预订链接"
    }
  ]
}

统一房型模型

{
  "room_id": "房型ID",
  "name": "房型名称",
  "bed_type": "床型",
  "area": "面积",
  "floor": "楼层",
  "capacity": "入住人数",
  "facilities": ["房间设施"],
  "sources": [
    {
      "platform": "平台标识",
      "external_id": "平台房型ID",
      "price": "价格",
      "breakfast": "早餐",
      "cancel_policy": "取消政策"
    }
  ]
}

聚合算法

去重策略

  1. 名称匹配:模糊匹配酒店名称相似度 > 85%
  2. 地址匹配:地址相似度 > 80%
  3. 坐标匹配:距离 < 500米
  4. 人工审核:疑似重复标记待审核

排序策略

  1. 综合评分:价格 40% + 评分 30% + 距离 20% + 设施 10%
  2. 价格优先:最低价格优先
  3. 评分优先:最高评分优先
  4. 距离优先:最近距离优先

响应规则

成功响应

{
  "code": 0,
  "msg": "success",
  "data": {
    "total": 100,
    "page": 1,
    "page_size": 10,
    "hotels": [
      {
        "hotel_id": "AGG_123456",
        "name": "桔子酒店(北京三元桥店)",
        "star_level": "舒适型",
        "score": 4.7,
        "address": "朝阳区三元桥...",
        "best_price": 483,
        "best_source": "携程",
        "sources_count": 3,
        "sources": ["携程", "美团", "分贝通"]
      }
    ],
    "sources_status": {
      "携程": "success",
      "美团": "success",
      "分贝通": "timeout"
    }
  }
}

失败响应

{
  "code": 500,
  "msg": "错误信息",
  "data": null
}

Comments

Loading comments...