Search hotels by city, dates, and guests using Amadeus API, returning availability and pricing in JSON format via a Go CLI tool.

This skill appears to do what it says (a Go CLI that calls the Amadeus API), but review and accept these trade-offs before installing: - Credentials storage: The tool stores your Amadeus API Key, Secret, and cached token in a YAML config file under $HOME/.config/hotel-pricer/config.yaml (written by viper). Those values are stored unencrypted, so restrict file permissions and consider using an alternative secret storage (OS keyring or environment variables) if you need stronger protection. - SKILL.md claims 'securely manages' credentials — that wording is stronger than the implementation; treat the stored secrets as plaintext on disk. - Installation: You must build locally with 'go build' (SKILL.md requirement). The registry metadata did not list 'go' as a required binary, so ensure you have Go installed. Moving the built binary to /usr/local/bin requires sudo. - API endpoint: The code's API base is set to the Amadeus test host (https://test.api.amadeus.com). Confirm whether you intend to use the test environment or need to change the base URL to production before running. - Token caching: Access tokens are written back to the same config file. If multiple users share the account or machine, ensure appropriate file permissions. If you are comfortable with these points, the skill is internally consistent. If you need secrets encrypted at rest or automated installation, request or inspect changes to support those requirements.

Type: OpenClaw Skill Name: hotel-pricer Version: 1.1.1 The skill bundle implements a Go-based CLI for searching hotel availability and pricing using the Amadeus API. All code and documentation align with the stated purpose. API credentials and tokens are securely stored in a user-specific configuration file (`~/.config/hotel-pricer/config.yaml`), and all network communication is directed to the legitimate Amadeus API endpoint (`https://test.api.amadeus.com`). There is no evidence of data exfiltration, unauthorized command execution, persistence mechanisms, or prompt injection attempts in SKILL.md or other files.