ClawHub

TripGenie

v1.0.2

Use for any travel question — hotels, flights, trains, attractions, destinations, and travel tips worldwide.

⭐ 0· 105·0 current·0 all-time
by@trips-ai
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description (travel queries) matches required pieces: an API key (TRIPGENIE_API_KEY) and the ability to call HTTP endpoints via curl/jq. There are no unrelated credentials, binaries, or config paths requested.
ℹ
Instruction Scope
SKILL.md stays within scope: it defines inputs, shows curl + jq calls to TripGenie endpoints, and instructs processing responses before presenting them. One notable risk: it permits an interactive fallback where the user can paste the API key into chat for a single call — this is explicitly warned against in the doc, but still increases chance of accidental exposure or retention in chat history. The instructions do not reference any unrelated files, system paths, or other environment variables.
✓
Install Mechanism
Instruction-only skill with no install spec or code files; requires only binaries expected for HTTP requests and JSON handling (curl, jq). No downloads or archived installs are performed.
✓
Credentials
Only one required env var (TRIPGENIE_API_KEY) is requested and is appropriate for a third-party API integration. No extra or unrelated secrets, config paths, or broad permissions are requested.
ℹ
Persistence & Privilege
Skill does not request always:true and has no install-time persistence. The default allowing autonomous invocation is enabled (platform default) — this is normal, but you should review agent/platform settings if you want to restrict automatic calls to an external service to control cost, rate limits, and data exposure.
Assessment
This skill appears to do what it says: call TripGenie APIs for travel queries. Before installing: (1) Prefer setting TRIPGENIE_API_KEY as an environment variable rather than pasting it into chat — the SKILL.md allows an in-chat fallback which increases risk of accidental exposure or retention in logs; (2) Confirm you trust https://tripgenie-openclaw-prod.trip.com / Trip.com as a data processor for your queries and check the API key's scope, billing, and rate limits; (3) If you want to limit potential cost or data leakage, disable or restrict autonomous skill invocation in your agent/platform settings so calls are always user-approved; (4) Do not share screenshots or logs that include the key. If you need higher assurance, ask the skill author to remove the in-chat fallback and rely strictly on environment-provided credentials.

Like a lobster shell, security has layers — review code before you run it.

latestvk9773qz75anq0v3b6amsnfep1d849rmf

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

✈️ Clawdis
Binscurl, jq
EnvTRIPGENIE_API_KEY

Comments