Paradiz

Отвечать клиентам в VK по стоимости отдыха на основе Excel-прайса. Использовать, когда нужно быстро посчитать цену по датам, количеству гостей и номеру, и вы...

This skill appears to implement quoting, holds, and booking saving as described, but review these points before installing: - Telegram notifications: the scripts will send guest PII (name, phone, email, dates, room, amount) to a Telegram chat. Confirm you want that and verify which chat ID/bot will be used. - Undeclared credential access: the code reads /home/openclaw/.openclaw/openclaw.json to find a PARADIZ_TG_BOT_TOKEN or a global Telegram bot token. The skill registry lists no required env vars — ask the author to declare PARADIZ_TG_BOT_TOKEN and PARADIZ_TG_CHAT_ID (or document reliance on the global config) so you can control which credentials it uses. - Data residency: the skill writes bookings and holds to files and may update SQLite DBs under the workspace; ensure those paths are acceptable and that backups are handled appropriately. - Privacy & compliance: because customer personal data is stored and transmitted, confirm you have consent/policies in place and that the Telegram destination is trusted. If you cannot verify the Telegram config or do not want PII sent to an external chat, do not enable notifications or run the save_booking.py with --notify, and request the author to make credential usage explicit.

Type: OpenClaw Skill Name: paradiz Version: 1.0.0 The skill is classified as suspicious primarily due to a potential XML injection vulnerability in `scripts/save_booking.py`. When generating booking documents in `.docx` format from a `.dotx` template, user-controlled input (e.g., guest names, notes) is directly replaced into the XML content without proper XML escaping. This could lead to malformed documents or, in a worst-case scenario with a vulnerable document viewer, allow for XML-related attacks (e.g., XXE). Additionally, the skill handles sensitive Personally Identifiable Information (PII) such as guest names, phone numbers, and emails, storing them in local files (`data/bookings.txt`, `data/bookings.jsonl`, `data/holds.jsonl`) and transmitting them to an external Telegram API endpoint (api.telegram.org). While these actions align with the stated booking management purpose, the combination of PII handling and a document generation vulnerability warrants a 'suspicious' classification, as it presents a risk of data integrity issues or potential exploitation, even if not explicitly malicious in intent.