功能描述

Hostex (hostex.io) OpenAPI v3.0 skill for querying and managing vacation rental properties, room types, reservations, availability, listing calendars, guest messaging, reviews, and webhooks via the Hostex API. Use when you need to integrate with Hostex API using a Hostex PAT (Hostex-Access-Token / HostexAccessToken) or when you need safe, intent-level API calls (read-only by default, optional write operations with explicit confirmation).

使用说明 (SKILL.md)

Hostex API Skill (Node)

Name: Hostex
Author: ansonfreeman

Auth (PAT)

Set env var: HOSTEX_ACCESS_TOKEN
Requests use header: Hostex-Access-Token: \x3CPAT>
OpenAPI security scheme name: HostexAccessToken

Default recommendation: use a read-only PAT.

Dates / timezone

All date params are YYYY-MM-DD
Interpret dates in property timezone (no UTC timestamps)

OpenAPI source of truth

Stable OpenAPI JSON:

https://hostex.io/open_api/v3/config.json

Use scripts/openapi-sync.mjs to cache a local copy into references/openapi.json.

Quick commands (scripts)

All scripts expect HOSTEX_ACCESS_TOKEN.

Read-only (safe)

List properties:

node skills/hostex/scripts/hostex-read.mjs list-properties --limit 20

List reservations (by check-in range):

node skills/hostex/scripts/hostex-read.mjs list-reservations --start-check-in-date 2026-02-01 --end-check-in-date 2026-02-28 --limit 20

List reservations (by reservation code):

node skills/hostex/scripts/hostex-read.mjs list-reservations --reservation-code 0-1234567-abcdef

Get availability:

node skills/hostex/scripts/hostex-read.mjs get-availabilities --start 2026-02-10 --end 2026-02-20 --property-id 123

Writes (guarded)

Writes are disabled unless:

HOSTEX_ALLOW_WRITES=true

and you pass --confirm.

Send message:

HOSTEX_ALLOW_WRITES=true node skills/hostex/scripts/hostex-write.mjs send-message --conversation-id 123 --text "Hello!" --confirm

Update listing prices (single range example):

HOSTEX_ALLOW_WRITES=true node skills/hostex/scripts/hostex-write.mjs update-listing-prices \
  --channel-type airbnb \
  --listing-id 456 \
  --start 2026-02-10 \
  --end 2026-02-15 \
  --price 199 \
  --confirm

Update listing prices (multi-range in one request):

HOSTEX_ALLOW_WRITES=true node skills/hostex/scripts/hostex-write.mjs update-listing-prices \
  --channel-type booking_site \
  --listing-id 100541-10072 \
  --prices "2026-02-03..2026-02-05:599,2026-02-06..2026-02-07:699,2026-02-08..2026-02-09:599" \
  --confirm

Create reservation (Direct Booking) (example):

HOSTEX_ALLOW_WRITES=true node skills/hostex/scripts/hostex-write.mjs create-reservation \
  --property-id 123 \
  --custom-channel-id 77 \
  --check-in-date 2026-02-10 \
  --check-out-date 2026-02-12 \
  --guest-name "Alice" \
  --currency USD \
  --rate-amount 200 \
  --commission-amount 0 \
  --received-amount 200 \
  --income-method-id 3 \
  --confirm

Update property availabilities (close/open) (example):

# Close a property for a date range
HOSTEX_ALLOW_WRITES=true node skills/hostex/scripts/hostex-write.mjs update-availabilities \
  --property-ids "11322075" \
  --available false \
  --start-date 2026-02-03 \
  --end-date 2027-02-02 \
  --confirm

Operational guardrails (mandatory)

When doing any write operation:

Summarize the change (who/what/when/how much).
Require the user to explicitly confirm (e.g. CONFIRM).
Prefer --dry-run first if available.

Notes

Pagination: endpoints commonly accept offset + limit (limit max 100).
Never print tokens in logs; scripts redact secrets automatically.

安全使用建议

This package appears to be a straightforward Hostex API client (read operations by default, write operations require HOSTEX_ALLOW_WRITES=true and --confirm). However: 1) the registry metadata claims no required credentials even though the SKILL.md and scripts require HOSTEX_ACCESS_TOKEN (and optionally HOSTEX_ALLOW_WRITES and HOSTEX_BASE_URL) — treat this as a red flag and verify the publisher before supplying credentials; 2) prefer creating and using a read-only Hostex PAT; 3) if you run the included scripts, run them in an isolated environment and check what they log (the code redacts tokens but error objects may include redacted token snippets); 4) enabling HOSTEX_ALLOW_WRITES grants the skill the ability to make changes — require staged tests and manual confirmation; 5) verify hostex.io and the unknown skill source (no homepage) to ensure you're not giving credentials to a malicious or typo-squatted endpoint. If you want higher assurance, ask the publisher to correct the registry metadata to declare HOSTEX_ACCESS_TOKEN as the primary credential and provide a verifiable source/homepage.

功能分析

Type: OpenClaw Skill Name: hostex Version: 0.1.1 The skill bundle is designed for legitimate interaction with the Hostex API, providing both read and guarded write operations. Key security indicators include explicit 'Operational guardrails' in SKILL.md instructing the AI agent to summarize changes and require user confirmation for write operations, and the `scripts/hostex-write.mjs` code enforces these by checking `HOSTEX_ALLOW_WRITES=true` and a `--confirm` flag. The `scripts/hostex-client.mjs` file also includes `redactSecret` for token handling in logs. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or obfuscation. The `openapi-sync.mjs` script fetches the OpenAPI spec from a legitimate Hostex domain (hostex.io) for local caching.

能力评估

ℹ Purpose & Capability

Name/description, OpenAPI file, and scripts consistently implement a Hostex API client (read and guarded write operations). However the registry metadata lists no required credentials while the SKILL.md and scripts require HOSTEX_ACCESS_TOKEN (and optionally HOSTEX_ALLOW_WRITES/HOSTEX_BASE_URL). This metadata mismatch is unexpected.

✓ Instruction Scope

SKILL.md and the scripts restrict actions to the Hostex API and local OpenAPI caching; write operations are gated by an environment flag and explicit --confirm flow. There are no instructions to read unrelated files or exfiltrate data to third-party endpoints.

✓ Install Mechanism

No install spec (instruction-only). Scripts are included in the bundle but there is no download-from-URL or third-party package installation. Risk from install mechanism is low.

⚠ Credentials

The skill legitimately requires an API token (HOSTEX_ACCESS_TOKEN) and optionally HOSTEX_ALLOW_WRITES and HOSTEX_BASE_URL, but the registry metadata declares no required env vars or primary credential. Requesting a Hostex PAT is proportional for the stated purpose, but the omission from metadata is an incoherence that should be resolved before granting credentials.

✓ Persistence & Privilege

always is false and the skill does not request automatic persistent privileges or modify other skills. The openapi-sync script writes a local openapi.json copy under skills/hostex/references, which is reasonable for caching but worth noting.

版本历史

v0.1.1

- Added support and documentation for updating listing prices with multiple date/price ranges in a single request. - Added support and example for updating property availabilities (close/open) via the script interface.

v0.1.0

Initial release of Hostex skill for managing vacation rental operations via Hostex API. - Supports querying and managing properties, room types, reservations, availability, calendars, guest messaging, reviews, and webhooks. - Utilizes Hostex Personal Access Token (PAT) authentication with read-only by default for safety. - Read and write operations available via Node scripts; write operations require explicit confirmation and an environment guard. - Dates are handled in property timezone using `YYYY-MM-DD` format. - Operational guardrails enforce summarization and explicit confirmation for any API changes. - Pagination and token security are built in; secrets are never printed in logs.

元数据

Slug hostex

版本 0.1.1

许可证 —

累计安装 0

当前安装数 0

历史版本数 2

常见问题

Hostex 是什么？

Hostex (hostex.io) OpenAPI v3.0 skill for querying and managing vacation rental properties, room types, reservations, availability, listing calendars, guest messaging, reviews, and webhooks via the Hostex API. Use when you need to integrate with Hostex API using a Hostex PAT (Hostex-Access-Token / HostexAccessToken) or when you need safe, intent-level API calls (read-only by default, optional write operations with explicit confirmation). 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 1806 次。

如何安装 Hostex？

在 OpenClaw 或 Claude Code 对话框中运行命令「/install hostex」即可一键安装，无需额外配置。

Hostex 是免费的吗？

是的，Hostex 完全免费（开源免费），可自由下载、安装和使用。

Hostex 支持哪些平台？

Hostex 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。

谁开发了 Hostex？

由 Anson（@ansonfreeman）开发并维护，当前版本 v0.1.1。

Hostex