Umy Hotel

An out-of-the-box hotel search skill powered by Umy MCP.

Security Scan

The skill's stated documentation and data-handling promises conflict with included executable code and endpoints; it may behave differently than described and could transmit user input to external APIs if the agent doesn't enforce the advertised PII filtering.

Purpose & Capability

The skill claims to be an instruction-only hotel search using a public key and requiring no user config, which aligns with a hotel-search purpose — but the package actually includes an executable Node CLI (scripts/umy_hotel_tool.mjs) that performs network calls. The presence of an executable contradicts the SKILL.md statement that the skill contains no executable code. Also SKILL.md references an MCP SSE endpoint (mcp.umy.com/sse) while the script uses api.umy.com/v1, which is inconsistent.

Instruction Scope

SKILL.md instructs agents to strip PII and only send structured hotel parameters, and even states 'never forward the user's raw input directly'. However, the provided CLI will POST whatever parameters it receives (including query) to an external API with no built-in PII-filtering. The skill relies on the agent/platform to enforce filtering but includes code that will transmit input if executed or used by an agent tool integration.

Install Mechanism

There is no install spec (instruction-only), which is low-risk. However, a runnable script file is bundled (scripts/umy_hotel_tool.mjs). Because nothing is automatically installed by the registry, risk depends on whether the agent/platform executes this script or exposes it as a tool — the presence of an executable file is inconsistent with the 'no executable code' claim in SKILL.md.

Credentials

SKILL.md declares no required environment variables and advertises a built-in public API key. The script respects an optional UMY_API_KEY env var (fallback to the public key). Requesting or using the public key is proportionate to a hotel search skill, but the script will use whatever API key is present in the environment (not declared as required), which should be noted by users who might set environment credentials.

Persistence & Privilege

Skill flags are default (always:false, agent-invocable:true). It does not request persistent system privileges or modify other skills. Autonomous invocation is permitted (platform default) but not combined with an 'always' flag or broad credential requests.

What to consider before installing

This skill advertises strict PII filtering and 'no executable code' but includes a runnable CLI that will send parameters to external endpoints. Before installing or running it, consider: 1) Do not paste or send personal data (names, phone numbers, emails, IDs) into queries — the skill's filtering is advisory, not enforced in the bundled script. 2) Inspect the script yourself or run it in an isolated environment; it calls https://api.umy.com/v1 and will include X-API-Key (falls back to the public key). 3) Ask the publisher to clarify the MCP vs API endpoint mismatch and why SKILL.md says no executable code. 4) If you want stronger guarantees, only use a version that either contains no executables or whose code you have reviewed and that enforces PII removal client-side. 5) If you set UMY_API_KEY in your environment, be aware the script will use it; keep any custom key secret and limited in scope.

Umy Hotel Search

Description

An out-of-the-box hotel search skill powered by Umy MCP.

Credentials

This skill uses a public API key provided by Umy. No user configuration is required.

Public API Key Declaration

• The built-in key (umyf1a1e67eae96d612c0d5a09e2d9cdf4f) is a public access key officially provided by Umy.
• This key is intended for community developers and is not a secret credential.
• The public key is rate-limited. For higher quota, apply for a dedicated key.
• Apply at: https://mcp.umy.com/apply

MCP Configuration

{
  "mcpServers": {
    "aigohotel-mcp": {
      "url": "https://mcp.umy.com/sse",
      "type": "http",
      "headers": {
        "X-API-Key": "umyf1a1e67eae96d612c0d5a09e2d9cdf4f"
      }
    }
  }
}

Data Transmission Policy

Allowed data

Only structured hotel search parameters:

• Location, dates, number of guests, star rating, budget

Prohibited data

• Personal information (name, phone number, email)
• Local files, system information
• Unrelated free-form text

query handling rules

The query parameter must contain only the hotel name. The agent must:

• Extract hotel-name-related information
• Remove any personally identifiable information (PII)
• Never forward the user's raw input directly

The agent must filter sensitive information before calling tools.

Security responsibility statement

This skill is instruction-based and contains no executable code. Data filtering responsibilities:

1. Agent runtime: executes PII filtering instructions
2. MCP server: performs security validation on requests
3. User: avoid entering sensitive personal information in queries

This skill provides reasonable disclosure; actual filtering enforcement depends on the agent platform.

Tools

• search_hotel: search hotels

Usage Examples

• "Find 5-star hotels in Beijing"
• "Show room types and prices for Beijing Tianlun Dynasty Hotel"
• "Hotels in Shanghai under 1000 CNY"