Tongcheng Chengxin Travel Search

同程程心 Skill - 基于同程旅行大模型（程心）的在线旅游搜索能力。提供更专业的机票、火车票、酒店、度假产品（自由行/跟团游）、旅游攻略、行程规划、特价机票、汽车票、长途汽车、景区、门票等的查询能力，基于同程官方数据，更加实时准确可靠，一键进入预订页面，让旅行更简单，更快乐。

This package appears coherent for a Tongcheng (同程) travel-search assistant: it runs node scripts and uses one API key (CHENGXIN_API_KEY) to call remote travel resources. Before installing or enabling it for sensitive usage, do the following checks: - Review the api-client and any networking code (scripts/lib/api-client.js and any files omitted from the manifest) to confirm the exact remote endpoints, headers, and how CHENGXIN_API_KEY is used (e.g., is it sent only to official same-domain endpoints?). The files performing HTTP calls were not fully shown in the review and are the primary place to verify no unexpected telemetry or exfiltration exists. - Confirm the API key's required scope and rotate/limit the key you provide (use a key with minimal permissions and monitor usage). Avoid reusing a long-lived, highly privileged key. - Be aware that the skill will forward whatever users type in --extra to the remote API. If users might include sensitive personal data (IDs, passport numbers, payment details), consider sanitizing before forwarding or warn users accordingly. - If you will run these scripts on shared infrastructure, run them in an isolated environment (container) until you have validated the endpoints and behavior. If you can inspect api-client.js and verify it calls only the official Chengxin endpoints and uses the API key appropriately, confidence increases and the skill can be considered coherent with its stated purpose.

Type: OpenClaw Skill Name: tc-chengxin Version: 0.8.1 The tc-chengxin skill bundle is a legitimate travel assistant integration for Tongcheng Travel's 'Chengxin' API. It provides a suite of Node.js scripts (e.g., flight-query.js, train-query.js, hotel-query.js) to fetch real-time travel data from official endpoints (https://wx.17u.cn). The code is well-structured, featuring robust parameter sanitization, clear error handling, and platform-specific output formatting (tables vs. cards). There is no evidence of malicious intent, data exfiltration, or prompt injection; the skill strictly follows its stated purpose of facilitating travel searches and bookings.