Security audit
Security checks across malware telemetry and agentic risk
The skill appears to perform W hotel searches, but it embeds a shared proxy token and sends travel queries through an environment-defined proxy, so it should be reviewed before use.
Install only if you are comfortable with your hotel search details being sent to the skill's proxy and downstream travel services. The code does not show destructive behavior or local data collection, but the embedded shared token and unconstrained proxy URL are security hygiene issues that should be fixed or clarified by the publisher.
method="POST",
)
try:
resp = urllib.request.urlopen(req, timeout=timeout)
data = json.loads(resp.read().decode("utf-8"))
if data.get("status") == "error":
return {"success": False, "error": data.get("message", "未知错误")}64/64 vendors flagged this skill as clean.
No suspicious patterns detected.