Rail Ticket Helper

分贝通火车预订助手，实时查询火车票、展示车次列表、预订火车票、查看订单、取消订单。Invoke when user wants to search trains, book train tickets, check train orders, or cancel train bookings.

The skill appears to implement exactly what it says (search/book/cancel via Fenbeitong APIs). Before installing: (1) verify the publisher/source since homepage is missing and source is 'unknown'; (2) be aware the skill sends passenger PII (names, ID numbers, phones) to https://openapiv2.fenbeitong.com and related Fenbeitong endpoints—only use if you trust that service and have consent to transmit that data; (3) the Python code requires the 'requests' package but the skill does not declare it—ensure your runtime has requests installed; (4) confirm the embedded X-App-Id/EMP_ID are legitimate for your use-case (the skill operates under that app identity); (5) if you need higher assurance, review network requests or run the scripts in an isolated environment and inspect API responses and behavior before using with real passenger data.

Type: OpenClaw Skill Name: rail-ticket-helper Version: 1.0.0 The skill contains hardcoded sensitive identifiers, specifically 'X_APP_ID' and 'EMP_ID', within 'scripts/fb_train_api.py'. While the code appears to legitimately implement train booking functionality via the Fenbeitong OpenAPI (openapiv2.fenbeitong.com), hardcoding these credentials is a significant security vulnerability that could lead to unauthorized account access or session hijacking. There is no evidence of intentional data exfiltration to unauthorized third-party domains, but the use of static employee IDs for all transactions is a high-risk practice.