← 返回 Skills 市场

Amadeus Flight Query

Name: Amadeus Flight Query
Author: kirorab

作者 kirorab · GitHub ↗ · v1.0.0

cross-platform ⚠ suspicious

885

总下载

当前安装

版本数

在 OpenClaw 中安装

/install amadeus-flights

功能描述

Query flight offers (price, schedule, availability) via Amadeus API. Use when user asks about flight/机票/航班 prices, schedules, or availability.

使用说明 (SKILL.md)

Flight Query (Amadeus)

Query real-time flight offers including price, schedule, stops, and seat availability.

Setup

Set environment variables (or hardcoded defaults are used):

export AMADEUS_API_KEY=your_key
export AMADEUS_API_SECRET=your_secret
# For production (real data):
export AMADEUS_BASE_URL=https://api.amadeus.com

Query Flights

node {baseDir}/scripts/query.mjs \x3CFROM_IATA> \x3CTO_IATA> [-d YYYY-MM-DD] [options]

Examples

# Hong Kong to Shanghai
node {baseDir}/scripts/query.mjs HKG PVG -d 2026-02-25

# Direct flights only
node {baseDir}/scripts/query.mjs SWA HGH -d 2026-02-24 --direct

# Business class
node {baseDir}/scripts/query.mjs HKG PVG -d 2026-02-25 -c BUSINESS

# JSON output
node {baseDir}/scripts/query.mjs HKG PVG -d 2026-02-25 --json

Options

-d, --date \x3CYYYY-MM-DD>: Departure date (default: today)
-a, --adults \x3Cn>: Number of adults (default: 1)
-c, --class \x3Cclass>: ECONOMY, PREMIUM_ECONOMY, BUSINESS, FIRST
--direct: Non-stop flights only
-n, --max \x3Cn>: Max results (default: 20)
--currency \x3Ccode>: Currency code (default: CNY)
--json: Raw JSON output

Airport Lookup

node {baseDir}/scripts/airports.mjs 揭阳    # → SWA
node {baseDir}/scripts/airports.mjs 杭州    # → HGH
node {baseDir}/scripts/airports.mjs tokyo   # API lookup

Built-in mappings for 40+ Chinese cities. Falls back to Amadeus API for others.

Notes

Test environment returns simulated data; production returns real prices
Switch to production: set AMADEUS_BASE_URL=https://api.amadeus.com
Free tier: 2000 calls/month (production)

安全使用建议

This skill appears to legitimately call the Amadeus API, but take these precautions before installing or using it: - The scripts include hardcoded API key and secret defaults and default to Amadeus's test endpoint. Treat those embedded credentials as potentially sensitive (or potentially public test credentials). Remove or replace them with your own keys and never rely on the bundled defaults for production. - SKILL.md mentions AMADEUS_BASE_URL but that env var is not listed in the declared requirements — make sure to set AMADEUS_BASE_URL to https://api.amadeus.com for production if you want real data. Confirm any environment variables used by the code are intentionally set. - Review the two provided scripts (scripts/airports.mjs and scripts/query.mjs) yourself; they perform HTTP requests to Amadeus endpoints and will send whatever API key/secret they have access to. If you must keep these scripts, remove hardcoded secrets and ensure the runtime environment injects only the intended credentials. - Because the skill will make network calls, consider whether you trust the destination (Amadeus) and that network access is acceptable in your environment. Monitor usage and rotate keys if you install and use the skill. If you want the skill to be acceptable for production use: remove embedded credentials, update SKILL.md to declare AMADEUS_BASE_URL, and ensure the required env var list matches what the code reads.

功能分析

Type: OpenClaw Skill Name: amadeus-flights Version: 1.0.0 The skill is classified as suspicious primarily due to the hardcoded Amadeus API keys and secrets found in `scripts/airports.mjs` and `scripts/query.mjs`. While the `SKILL.md` mentions that hardcoded defaults are used if environment variables are not set, and the keys appear to be for a test environment (`test.api.amadeus.com`), hardcoding credentials in source code is a significant security vulnerability that can lead to exposure and misuse. The code otherwise appears to align with its stated purpose of querying flight information, without evidence of prompt injection, data exfiltration, or other malicious behaviors.

能力评估

✓ Purpose & Capability

Name, description, required binaries (node), and the code all align with a flight-query integration for the Amadeus API. The requests the skill makes (Amadeus endpoints) are coherent with the stated purpose.

ℹ Instruction Scope

SKILL.md instructs running the provided node scripts and only references Amadeus endpoints. It also documents AMADEUS_BASE_URL for switching between test and production. The runtime instructions do not ask for unrelated system files or credentials beyond Amadeus, but the docs say 'hardcoded defaults are used' — and the code indeed contains default API credentials and defaults the base URL to a test endpoint.

✓ Install Mechanism

No install spec is provided (instruction-only deployment). No third-party downloads or archive extraction occur; this minimizes install-time risk.

⚠ Credentials

The skill requires only AMADEUS_API_KEY and AMADEUS_API_SECRET which match the service. However: (1) the code also reads AMADEUS_BASE_URL (used for switching to production) but this variable is not listed in the declared required env vars — a documentation mismatch; (2) both scripts include hardcoded default API key and secret values and default to a test API base. Shipping credentials (even for a test environment) in-source is a security concern: they may be valid, reused, or abused by anyone with access to the skill bundle.

✓ Persistence & Privilege

The skill does not request elevated persistence (always:false). It does not modify other skills or agent-wide configs. Autonomous invocation is allowed but not unusual and is not combined with any other high privilege.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install amadeus-flights
安装完成后，直接呼叫该 Skill 的名称或使用 /amadeus-flights 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

Initial release: query flight offers via Amadeus API with price, schedule, stops, seat availability

元数据

Slug amadeus-flights

版本 1.0.0

许可证 —

累计安装 2

当前安装数 2

历史版本数 1

常见问题