TravelSmart

自驾出行决策助手 - 高速出口推荐、途中住宿、打车点推荐三大场景。 高德地图 Web API + 多因子评分算法，支持 CLI / Web / 飞书三种使用方式。 必填环境变量：AMAP_KEY（高德地图）；可选：MINIMAX_API_KEY、FEISHU_APP_ID、FEISHU_APP_SECRET。

Things to check before installing/running: - The code requires an AMAP_KEY (Amap Web API). The registry metadata omitted this — set AMAP_KEY yourself and verify you understand its use. - Feishu integration is optional but if you set FEISHU_APP_ID/FEISHU_APP_SECRET the server will attempt to post messages. The code has a default FEISHU_CHAT_ID value; override it or remove the default to avoid sending messages to an unexpected chat. - server.py binds to 0.0.0.0 and exposes /notify with no authentication. If you run the server, bind to localhost (127.0.0.1) or firewall the port, or implement auth for /notify before exposing it to other hosts. - RouterAgent can call an external LLM (minimaxi) if MINIMAX_API_KEY is provided; this will transmit user-provided text to that service. Only provide LLM keys if you accept that. - Review config/api_keys.yaml/.env example to ensure secrets are stored safely and not committed to public repos. - Overall: code looks consistent with its purpose, but address the undocumented/default Feishu chat id, the manifest omission for AMAP_KEY, and the unauthenticated public endpoint before deploying in a shared or public environment.

Type: OpenClaw Skill Name: pete2048-travel-smart Version: 1.0.2 The skill bundle contains a hardcoded Feishu (Lark) Chat ID (oc_b596d3738065b40181b73144a8943999) and a '/notify' endpoint in 'server.py' that is unrelated to the travel assistant's core functionality. This endpoint is described as a callback for a 'quantitative system' and allows external entities to send messages to the hardcoded chat using the user's FEISHU_APP_ID and FEISHU_APP_SECRET. While the primary travel logic appears benign, the presence of an undocumented notification bridge to a specific external chat ID is a significant privacy risk and potential data exfiltration vector.