Hotel Asset Marketer

Before installing or enabling this skill, consider the following: - Manifest mismatch: The catalog entry claims no required binaries/credentials, but SKILL.md requires mcporter, curl, and tokens placed in the agent MCP config. Confirm with the publisher why the manifest omits these requirements. - Token handling: You will need to add a workspace API key (hp_sk_*) and a per-user AgentAuth key (uk_* ) into your agent MCP server configuration. Ensure you understand where those tokens will be stored and who/what can read them — putting long-lived keys into agent config can be sensitive. - Filesystem access: The skill insists on writing temporary images to /root/.openclaw/workspace/. That is a privileged path; verify the agent process runs with appropriate user separation and that writing here won't expose other sensitive files. Consider whether a less-privileged workspace path can be used. - feishu-send behavior: The skill expects a helper at /usr/local/bin/feishu-send that 'automatically reads credentials from OpenClaw config'. Inspect that binary (or ask for its source) to confirm it only reads intended config and doesn't exfiltrate other secrets. - Contradictions: SKILL.md forbids using curl/exec to call the MCP API but elsewhere lists curl as required for downloading images. Ask the author to clarify the precise runtime flow (are downloads performed by mcporter or by the agent via curl?). - Test in isolation: If you proceed, test in a non-production environment first, with minimal-scoped tokens, and monitor agent logs and network calls. Rotate keys after testing and prefer short-lived or workspace-scoped keys where possible. If you want, I can draft specific questions to ask the skill author (e.g., provide the expected agent config file path, the exact mcporter binary version required, and the feishu-send source) or suggest safer alternatives (use a non-root workspace path and confirm feishu-send audit).