Star Hotel Search
v2.0.0Smart hotel search, supporting filtering by location, date, star rating, and budget
⭐ 0· 405·1 current·1 all-time
by@zxc-aqr
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill is an instruction-only hotel search that calls an external MCP hotel API; the declared capability (search, details, tags) matches the tools and parameters described in the SKILL.md.
Instruction Scope
The SKILL.md tells the agent to remove PII before calling the external MCP endpoint and explicitly says the agent/runtime must perform filtering. That places critical data-protection responsibility on the agent rather than enforcing it in the tool. The skill will send user search parameters to an external server (mcp.aigohotel.com) — if the agent fails to filter PII correctly, sensitive data could be transmitted. Also the doc references two different domains (mcp.agentichotel.cn for application vs mcp.aigohotel.com for the API), which is an inconsistency worth verifying.
Install Mechanism
No install spec and no code files (instruction-only). This minimizes local disk impact and the usual install-related risks.
Credentials
The skill declares no required env vars or private credentials, which is coherent. However, it embeds a public API key directly in SKILL.md (mcp_a84000de01e04920b3690d173630f163) and an Authorization header for an external endpoint. Even if the key is described as 'public', embedding keys in skill text means any agent run will include that key when contacting the remote service — consider whether you trust that service and its rate limits/quota sharing model.
Persistence & Privilege
The skill does not request always:true or other elevated persistence, and it doesn't modify other skills. However, the normal autonomous-invocation capability combined with the skill's reliance on agent-side PII filtering increases the blast radius if the agent misapplies filters.
What to consider before installing
This skill appears to do what it says (hotel search), but it will send structured queries to an external MCP server using a public key embedded in the skill text and expects the agent to strip any PII before sending. Before installing or using it: (1) verify the external API domain and that you trust that service (the documentation shows two different domains — ask the author to clarify); (2) test only with non-sensitive queries to confirm PII is not transmitted; (3) consider requesting a private API key from the provider (or using a skill that requires you to provide your own key) so you can revoke it if needed; (4) avoid submitting names, phone numbers, emails, ID numbers, or other personal info in queries because filtering is implemented client-side and may fail. If you need higher assurance, ask the publisher for more details about their MCP endpoint and why the key is embedded.Like a lobster shell, security has layers — review code before you run it.
bookingvk971xz27sdgzd08ngy2kmf6njd81ypqbhotelvk971xz27sdgzd08ngy2kmf6njd81ypqblatestvk971xz27sdgzd08ngy2kmf6njd81ypqbtravelvk971xz27sdgzd08ngy2kmf6njd81ypqb
License
MIT-0
Free to use, modify, and redistribute. No attribution required.