中国酒店比价 - 专门针对美团、去哪儿、携程、飞猪、途牛等中国本土平台的酒店搜索、价格比较、套餐分析和个性化推荐。

What to check before installing or enabling this skill: 1) Inspect scripts/hotel-search-example.sh and the two omitted files for network destinations and shell commands. Ensure they only call well-known public endpoints (platforms or official hotel sites) and don't POST data to unknown servers. 2) Search all files for hidden/unprintable/unicode control characters and for the DSML-like blocks. Confirm any web_fetch or tool-invoke calls only use trusted domains (no personal servers, IP addresses, pastebins, or URL shorteners). 3) Clarify persistence: the docs describe storing user and family data and device/session recognition but the skill metadata does not request filesystem or config-path access. If you plan to allow history/profile persistence, require transparency about where data will be stored, encryption, and deletion workflows. 4) Verify that no credentials (payment, platform API keys) are being collected or required. If the skill needs APIs for deeper integration, demand explicit declared env vars and a privacy/security rationale. 5) Run the skill in a sandboxed environment first (or with network monitoring) to confirm it only fetches public pages for price checks and does not exfiltrate data. If you are not comfortable with hidden characters, undeclared filesystem usage, or unreviewed shell scripts, do not install or enable the skill until the maintainer provides cleared source (human-readable script contents), an explanation of the DSML/web_fetch invocations, and an explicit description of data persistence behavior and storage locations.

Type: OpenClaw Skill Name: china-hotel-comparison Version: 1.4.0 The skill bundle is largely benign, consisting of documentation and illustrative shell scripts that simulate hotel search and price calculation without performing actual external actions. However, the `multi-user-management.md` file contains a direct `<｜DSML｜invoke name="web_fetch">` instruction to the AI agent, instructing it to make an HTTP request to `https://www.shanghaidisneyresort.com/tickets/`. While this specific URL is relevant to the skill's stated purpose (e.g., for package value analysis), the explicit use of the `web_fetch` tool in a markdown file represents a risky capability. This capability, if exploited through prompt injection or dynamic URL generation, could lead to unauthorized data exfiltration or remote code execution, classifying the skill as suspicious due to this potential vulnerability.