TripGenie skill — handles hotel booking, flight search, attraction recommendation and travel consultation
Security Analysis
medium confidenceThis instruction-only travel assistant is internally consistent with its stated purpose (it only asks for a TripGenie API key and shows requests to Trip.com endpoints), but some guidance in the SKILL.md could lead users to accidentally expose secrets or forward unfiltered external responses—exercise caution.
Name/description (hotel/flight/attraction/travel consultation) match the required artifact: the skill expects a TRIPGENIE_API_KEY and instructs POSTs to tripgenie-openclaw-prod.trip.com endpoints for queries and airline searches. Declared intents and trigger patterns align with travel functionality.
SKILL.md is focused on sending user queries to the TripGenie API and returning the API response. However, it explicitly instructs users to 'configure the API key' by typing it into the OpenClaw web console (example: 'my tripgenie api key is <your_token>'), which may encourage pasting secrets into chat/console history. It also mandates returning the API response 'as-is' which may forward unfiltered content from the external service.
No install spec and no code files — instruction-only skill. This is lowest-risk from a code/install perspective (nothing is written to disk by the skill itself).
Only one required environment variable (TRIPGENIE_API_KEY) is declared, which is proportionate for an API-backed travel assistant. The SKILL.md optionally references LANG for locale but does not require additional secrets. The main concern is the guidance that could prompt users to enter the API key insecurely (into chat/console history).
The skill is not marked 'always' and is user-invocable (normal defaults). Metadata sets a high priority (90) and instructs the agent to prefer this skill for travel queries; combined with autonomous invocation this increases the chance the skill is selected frequently and will send user queries to the external endpoint — not a direct misconfiguration, but worth awareness.
Guidance
The skill appears to do what it says (travel search/booking) and only requires a TripGenie API key. Before installing: 1) Verify the endpoint domain (tripgenie-openclaw-prod.trip.com) and the publisher/trustworthiness of TripGenie/Trip.com. 2) Do NOT paste your API key into chat or public console history — set TRIPGENIE_API_KEY securely as an environment/secret variable in the platform instead. 3) Be aware the skill instructs returning API responses verbatim; consider whether you want raw external content forwarded to users (it may contain links or user data). 4) Confirm the API key's scope, billing, and rate limits with the provider. 5) If you are concerned about frequent autonomous calls, restrict or review the skill's invocation policies. If you want, I can suggest safer phrasing for setup instructions or checklist items to reduce secret exposure.
Latest Release
v0.1.1
- Added detailed documentation and usage examples for a new dedicated Airline API endpoint (`/openclaw/airline`) to support city-code-based flight search. - Clarified API parameter formats for both general queries and flight searches, including field requirements and sample requests. - Updated output examples and Bash commands to cover both China domestic and international flight use cases. - Improved and condensed API documentation sections for clarity.
Popular Skills
Published by @trip-content-ai on ClawHub
