Matrix Mate - ITA Matrix Flight Search and Parse Tool

Matrix Mate — ITA Matrix flight search and parse tool for parsing ITA Matrix itinerary links, auditing fare rules, and producing traveler-safe summaries thro...

This skill appears to do what it says: it expects you to run a local Matrix Mate app and to run npm install in the bundle root before starting the MCP server. Things to check before installing or running: 1) Be aware of and document the optional env vars MATRIX_MATE_BASE_URL and MATRIX_MATE_ALLOW_REMOTE_BASE_URL — by default network calls are restricted to loopback, only set the override if you trust a remote host. 2) Treat any pasted itinerary JSON or fare-rule text as untrusted input (the skill notes prompt-injection risk). 3) Review and run npm install in a controlled environment (npm packages are pulled from the registry). 4) The bundle does not require API keys or credentials; if you are asked later to add credentials or point to a hosted endpoint, reassess. Overall the bundle is coherent and local-first; the main fix I recommend is to declare the optional environment variables in the skill metadata so operators see them up front.

Type: OpenClaw Skill Name: matrix-mate-offline-skill Version: 1.0.3 The Matrix Mate skill bundle is a legitimate tool designed to interface with a local flight parsing application via the Model Context Protocol (MCP). It includes proactive security measures, such as a loopback-only enforcement check in `scripts/runtime/client.mjs` to prevent the agent from being used for SSRF, and explicit safety guardrails in `SKILL.md` and `SECURITY.md` that restrict the agent to read-only flight data analysis. The code logic is transparent, lacks obfuscation, and contains no evidence of data exfiltration or unauthorized command execution.