携程积分助手
PassAudited by ClawScan on May 10, 2026.
Overview
The included script only manages locally stored Ctrip points and product data, but the documentation mentions optional cookies and an unsupported cron/Feishu notification workflow users should verify.
This appears safe for local, manual tracking of Ctrip points and reward products. Before using any cookie-based or automatic notification workflow, verify what is actually installed, protect any cookie file, and do not assume cron or Feishu push is active from these artifacts alone.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If you manually place a Ctrip session cookie there, it could represent access to your Ctrip account if exposed locally.
The documentation describes optional storage of a Ctrip cookie even though the registry declares no primary credential. Cookies can grant account access, but the included code does not read, transmit, or use this cookie.
Cookie: `~/.openclaw/data/ctrip-cookie.txt` ... 自动更新需要 Cookie（可选）
Only add a cookie if you understand why it is needed, keep the file private, and revoke or refresh the session if you no longer use the skill.
If a cron job were separately configured, the skill could run later without direct interaction and send notifications.
This describes persistent scheduled monitoring and outbound notifications. It is disclosed and related to the skill purpose, but no install spec or included code actually creates or manages this cron job.
已设置 cron 任务，每天早上 9:00 自动检查积分商城新品，发现新商品会通过飞书推送。
Check `openclaw cron list` or your system cron before relying on the automation, and remove or disable any scheduled task you do not want.