自动搜索携程酒店，支持实时比价和详情获取。使用浏览器自动化技术，实现携程账号登录、酒店搜索、详情获取和对比分析功能。

This skill's core Node/Playwright code is coherent with its description (it automates Ctrip login and scraping). However, the repository contains additional Python utilities that call an external API gateway (gateway.maton.ai) and require a MATON_API_KEY that the skill metadata and SKILL.md do not mention. Before installing or running it: - Do not run the Python scripts (search_hotels.py / search_with_brave.py) unless you understand and trust maton.ai and want outbound searches routed there. They will send queries and use an Authorization header with your MATON_API_KEY. - Ask the author to clarify why maton.ai is included and to explicitly declare MATON_API_KEY (or remove those scripts). A legitimate Ctrip Playwright skill does not need that external API. - Avoid storing your Ctrip credentials or any API keys directly in repo files (api_key_config.py or config.json) in plain text; prefer environment variables or a secure secret store. The package currently suggests editing config.json for username/password and api_key_config.py for MATON_API_KEY—both increase risk of accidental credential leakage. - Note the Node version mismatch: package.json claims Node 16+ but the Playwright package in lockfile requires Node >=18. Use Node 18+ to avoid runtime problems. - If you still want to test the skill, run it in an isolated/sandbox environment, inspect network traffic, and only install/run the Node Playwright flow after confirming the Python utilities are safe or removed. If the author can remove or document the external MATON dependency, declare required env vars, and align Node version requirements, the package would be much clearer and less suspicious.

Type: OpenClaw Skill Name: ctrip-hotel-search Version: 1.0.0 The skill bundle is a legitimate automation tool designed to search and compare hotels on Ctrip using Playwright and Node.js. It includes modules for automated login (src/login.js), hotel searching (src/search.js), and data extraction (src/details.js). While the skill requires users to provide Ctrip credentials in a local configuration file and utilizes a third-party API gateway (gateway.maton.ai) for Brave Search queries, these behaviors are transparently documented and directly support the stated functionality. No evidence of malicious intent, credential exfiltration, or harmful prompt injection was found across the code or the extensive documentation.