酒店管家 Skill - 管理酒店 OTA 基础信息、房价库存及订单同步。

This skill appears to implement the advertised OTA management features, but review these before installing: - Metadata mismatch: The registry entry claims no required env vars, but SKILL.md and config.js expect several secrets (OTA_CTRIP_API_KEY, OTA_MEITUAN_API_KEY, INTERNAL_PMS_URL, INTERNAL_PMS_TOKEN). Treat those env vars as required unless the author fixes the metadata. - Config file: By default the code will try to read a local config file at resources/ota_config.json (or a path via HOTEL_MANAGER_CONFIG_PATH). Make sure any config files do not contain real secrets in a shared repo, or set env vars instead. - Browser automation: UI mode will instruct an agent-controlled browser to log in, click, edit fields and take screenshots. If you enable that mode, ensure the agent or environment is trusted and that screenshots won't be stored or transmitted to unintended locations. - Network endpoints: The OTA client will make HTTPS calls to platform endpoints and (if configured) to your internal PMS URL. Verify those endpoints are correct and that you trust the skill source before providing credentials. If you are not able to verify the author/source, run the skill in an isolated environment, remove sensitive credentials from repository files, and consider providing only the minimum-permission credentials required by the OTAs/PMS. If you want higher assurance, ask the publisher to correct the registry metadata and to document HOTEL_MANAGER_CONFIG_PATH and the exact set of env vars used.

Type: OpenClaw Skill Name: hotel-manager Version: 1.0.1 The hotel-manager skill is a legitimate integration tool for managing hotel data across OTA platforms like Ctrip and Meituan. It uses standard Node.js practices for API interaction (ota_client.js) and provides structured SOPs for browser-based automation (browser_controller.js). Sensitive credentials are appropriately handled via environment variables or local configuration files (config.js), and no evidence of malicious intent, data exfiltration, or unauthorized execution was found.