train

分贝通火车预订助手，实时查询火车票、展示车次列表、预订火车票、查看订单、取消订单。Invoke when user wants to search trains, book train tickets, check train orders, or cancel train bookings.

This skill appears to do what it claims: it will call fenbeitong OpenAPI endpoints to search trains, create/cancel orders, and return payment/view links. Before installing, be aware that you (or your users) will need to provide personal passenger information (name, national ID, phone) which the skill sends to external fenbeitong endpoints. The code includes a hard-coded X-App-Id and EMP_ID (no secret API key), so verify you trust fenbeitong's privacy and security practices. Also ensure python3 is available in the runtime. If you need tighter privacy or auditability, ask the author how passenger data is stored, logged, or transmitted, and whether requests can be routed through a service you control or audited.

Type: OpenClaw Skill Name: trains Version: 1.0.0 The skill contains hardcoded sensitive identifiers, specifically an `X_APP_ID` and an `EMP_ID` (Employee ID) within `scripts/fb_train_api.py`. This allows the agent to perform train bookings and queries under a specific, static identity on the Fenbeitong platform (openapiv2.fenbeitong.com), which could lead to unauthorized transactions or privacy leaks if deployed broadly. While this appears to be a significant security design flaw (vulnerability) rather than intentional malware, the hardcoding of identity tokens is a high-risk practice.