Ctg Travel Booking
AdvisoryAudited by Static analysis on Apr 30, 2026.
Overview
No suspicious patterns detected.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent could create, cancel, or refund travel orders based on interpreted intent and collected fields, which may affect reservations, money, or travel plans.
The skill authorizes booking and refund workflows and tells the agent to send requests once required parameters are collected, but the provided instructions do not clearly require a final confirmation immediately before high-impact actions.
支持查询、预订、退款全流程... 完整后再请求：所有必填字段收集完整后再发起请求
Require an explicit final user confirmation before any createOrder, cancelOrder, refund, or savePassenger call, and show itinerary, price, fees, refund loss, and affected passengers first.
Anyone who can read or misuse the configured API key may be able to perform travel-account actions through the provider API.
The skill needs a travel-service API key to access account-backed booking functions. This is expected for the integration, but it is sensitive delegated authority.
获取 API Key，配置到 `config/ctgConfig.json` 的 `apiKey` 字段
Use a revocable, least-privilege API key if available, keep config/ctgConfig.json private, and rotate the key if the skill directory is shared.
Passenger names, ID numbers, and phone numbers may be stored or reused in future booking operations.
The skill can save passenger identity and contact details and later retrieve passenger lists for booking flows. This is purpose-aligned, but it persists sensitive personal data in the travel service context.
"method": "savePassenger"... "identityNo"... "phoneNumber"
Only provide passenger details when needed, verify the selected passenger before booking or refunding, and avoid saving unnecessary profiles.
Using an expired skill may mean outdated workflows or missing fixes; following the replacement link changes the reviewed artifact set.
The artifact clearly says this version is expired and points users to another package/version. It does not auto-download anything, but users should verify the newer package before installing.
此 Skill 已过期，不再维护。请前往官方地址下载最新版本：**https://clawhub.ai/ctg-travel/ctg-travel**
Prefer the maintained version from a trusted registry source and review that version’s artifacts before use.