Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

行程预订中心

v1.0.0

Booking.com国际酒店预订助手,支持全球酒店搜索、房型查询、价格对比、预订管理。Invoke when user wants to search international hotels, book hotels on Booking.com, or manage Booking.com reservat...

0· 94·0 current·0 all-time
by赵瑞宇@ryan-zry·duplicate of @gaogao605/trip-booking

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for ryan-zry/trip-booking-hub.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "行程预订中心" (ryan-zry/trip-booking-hub) from ClawHub.
Skill page: https://clawhub.ai/ryan-zry/trip-booking-hub
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required binaries: python3
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install trip-booking-hub

ClawHub CLI

Package manager switcher

npx clawhub@latest install trip-booking-hub
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
Name/description match a Booking.com booking helper and the code implements search/detail/booking functions, which is coherent; however the SKILL.md insists on using Booking.com Affiliate API and API Key but the package does not declare or request any credentials or configuration mechanism — instead the code contains hard-coded placeholders (BOOKING_API_KEY = "your_api_key", BOOKING_AFFILIATE_ID = "your_affiliate_id"). That omission is inconsistent with the stated purpose and could force users to edit code to supply secrets.
!
Instruction Scope
SKILL.md restricts behavior (must call official Affiliate API, do not fabricate data) and documents endpoints. The included Python modules appear to call external endpoints via requests and also contain mocked returns and TODOs (i.e., real API calls are not implemented). The instructions do not explain how to supply credentials or where network traffic is sent at runtime beyond the documented Booking.com base URL, so runtime behavior may differ from the SKILL.md promise.
Install Mechanism
No install spec is provided (instruction-only installation), which minimizes installation risk — the skill only requires python3 on PATH and ships Python source files. No external archives or untrusted download URLs are used.
!
Credentials
The code requires an API key and affiliate ID to operate with Booking.com, but the skill declares no required environment variables or primary credential; credentials are hard-coded as placeholders in the source. This is disproportionate: an API-integrated skill should declare its credential requirements (env vars or config) rather than expect direct code edits. No other secrets are requested, which is appropriate, but the missing credential-handling is a red flag.
Persistence & Privilege
The skill does not request permanent/always-on presence, does not declare filesystem config paths, and is user-invocable only. There is no indication it modifies other skills or global agent settings.
What to consider before installing
Do not install or use this skill as-is. Before proceeding: (1) confirm you have a legitimate Booking.com affiliate/API account and integration rights; (2) insist the skill declare required credentials (e.g., BOOKING_API_KEY, AFFILIATE_ID) as environment variables or a secure config rather than hard-coding them into source; (3) review and complete the TODOs — the code currently returns mock data and appears incomplete/truncated, which may cause runtime errors or unexpected behavior; (4) verify all outbound network endpoints are the official Booking.com distribution endpoints and that no other hidden endpoints are contacted; (5) run the code in a sandboxed environment and avoid pasting real API keys until you’re satisfied; (6) prefer a version that uses standard credential handling (env vars, secrets manager) and explicit documentation of data flows. If the author cannot justify why credentials are left out or why code is incomplete, treat the package as untrusted.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🌍 Clawdis
Binspython3
latestvk97ahpgsp5zaghpnqex752by9n83wfg0
94downloads
0stars
1versions
Updated 4w ago
v1.0.0
MIT-0

Booking.com国际酒店预订助手 (fb-booking-skill)

技能描述

Booking.com国际酒店预订助手,支持全球200+国家和地区酒店搜索、房型查询、价格对比、预订管理。提供多语言、多币种支持,适合出境游、商务差旅等国际出行场景。


⚠️ 【重要约束】

  • 必须调用Booking.com Affiliate API或合作伙伴API获取数据
  • 禁止自行编造酒店信息、价格或评论
  • 国际酒店价格以当地货币显示,需标注汇率参考
  • 接口返回什么数据就展示什么,不要修改

技能概述

基于Booking.com API开发的国际酒店预订技能,支持:

  • 全球酒店搜索(200+国家/地区)
  • 多语言酒店信息展示
  • 多币种价格显示
  • 实时房态查询
  • 预订创建与管理
  • 免费取消政策查询

技能能力

核心能力

  1. 全球酒店搜索:支持按城市、地标、酒店名称搜索
  2. 多语言支持:中文、英文、日文、韩文等多语言展示
  3. 多币种显示:支持CNY、USD、EUR、JPY等货币
  4. 房型详情:床型、面积、设施、政策等详细信息
  5. 预订管理:创建订单、查询订单、取消订单

触发条件

  1. 国际酒店搜索:当用户搜索海外酒店、Booking酒店时

    • 支持城市名(英文/中文)
    • 支持地标(如东京塔、埃菲尔铁塔)
    • 支持酒店名称
  2. 展示格式示例

    🌍 Booking.com - 东京酒店(3月15日入住)
    
    | 序号 | 酒店名称 | 评分 | 区域 | 价格/晚 |
    |:---:|---------|:---:|------|---:|
    | 1 | 东京站酒店 | 9.2 | 千代田区 | ¥1,280 |
    | 2 | 新宿格拉斯丽酒店 | 8.8 | 新宿区 | ¥980 |
    
    💡 回复"序号"查看房型详情
    💡 价格已含税费,支持免费取消
    

对接信息

基础配置

支持功能

功能API端点说明
酒店搜索getHotels按城市/坐标搜索
酒店详情getHotelDescription酒店详细信息
房型查询getRoomAvailability实时房态和价格
预订创建makeReservation创建预订
订单查询getReservation查询订单详情
取消预订cancelReservation取消预订

核心接口列表

一、查询类接口

接口名称核心用途必选参数
search_booking_hotels搜索Booking酒店city_ids, checkin, checkout
get_booking_hotel_detail获取酒店详情hotel_id, language
get_booking_room_availability查询房型可用性hotel_id, checkin, checkout
get_booking_reviews获取酒店评论hotel_id, language

二、预订类接口

接口名称核心用途必选参数
create_booking_reservation创建预订hotel_id, room_id, guest_info
get_booking_reservation查询预订reservation_id
cancel_booking_reservation取消预订reservation_id

数据字段说明

酒店信息

{
  "hotel_id": "123456",
  "name": "Hotel Granvia Tokyo",
  "name_cn": "东京站酒店",
  "address": "1-9-1 Marunouchi, Chiyoda-ku",
  "city": "Tokyo",
  "country": "Japan",
  "zip": "100-0005",
  "latitude": 35.6812,
  "longitude": 139.7671,
  "review_score": 9.2,
  "review_count": 8542,
  "star_rating": 4,
  "currency": "JPY",
  "min_rate": 25000
}

房型信息

{
  "room_id": "987654",
  "name": "Deluxe Double Room",
  "name_cn": "豪华双人间",
  "bed_type": "1 extra-large double bed",
  "size": 28,
  "max_occupancy": 2,
  "facilities": ["Air conditioning", "Free WiFi", "TV"],
  "cancellation_policy": "Free cancellation",
  "meal_plan": "Breakfast included",
  "price": 28000
}

多语言支持

语言代码语言
zh中文
en英文
ja日文
ko韩文
fr法文
de德文
es西班牙文

多币种支持

币种代码币种
CNY人民币
USD美元
EUR欧元
JPY日元
KRW韩元
GBP英镑
HKD港币

响应规则

成功响应

{
  "code": 0,
  "msg": "success",
  "data": {
    "hotel_id": "123456",
    "name": "东京站酒店",
    "address": "东京都千代田区丸之内1-9-1",
    "review_score": 9.2,
    "rooms": [
      {
        "room_id": "987654",
        "name": "豪华双人间",
        "price": 28000,
        "currency": "JPY"
      }
    ]
  }
}

失败响应

{
  "code": 500,
  "msg": "Hotel not found",
  "data": null
}

Comments

Loading comments...