AI机票预订助手

AI机票助手 - 实现国内航班搜索、舱位查询、预订下单、机票改期、机票退票。适用于用户询问航班、查询机票价格、提交机票订单、改期航班、退票时使用。

This skill appears to implement the advertised flight search and booking flows, but I recommend caution before using it with real personal data. Specific concerns: (1) TLS verification is explicitly disabled for all HTTP requests — this makes the apiKey and passengers' PII vulnerable to man-in-the-middle attacks; (2) the SKILL.md states the apiKey is saved in ~/.fbt_auth.json but the code saves it in the system temp directory (tempfile.gettempdir()), which affects how long the key persists and who can access it; (3) despite advising not to log PII, the scripts print passenger names/phones/IDs and even raw order_data to stdout, which may be captured by application logs; (4) the code posts PII and auth tokens to an external domain (default https://app-gate.fenbeitong.com/...), so confirm you trust that service and review its privacy policy. Actions you can take before installing or using the skill: - Ask the author for the skill's homepage, provenance, and why TLS verification is disabled; require they remove ssl._create_unverified_context(). - Request they reconcile documentation vs. code for apiKey storage (explicit file path and file permissions), or change to store the key in a secure user config (home directory with appropriate permissions) and document it. - Ask for logs/printing of PII to be removed (no cleartext printing of identity numbers/phones). - If you must test, run it on an isolated system (not a shared machine), avoid using real personal data, and set FBT_API_URL to a controlled test endpoint if possible. If the author cannot justify or fix the above, treat the skill as high-risk for handling real PII.

Type: OpenClaw Skill Name: search-flight Version: 1.0.0 The skill bundle implements a flight booking assistant that handles sensitive Personal Identifiable Information (PII), including passenger names, phone numbers, and national ID numbers. A significant security vulnerability is present in `scripts/common.py`, where SSL certificate verification is explicitly disabled via `ssl._create_unverified_context()` for all API calls to `app-gate.fenbeitong.com`. This exposes sensitive user data and authentication tokens to Man-in-the-Middle (MitM) attacks. While the behavior aligns with the stated purpose and the code includes a comment acknowledging the risk, the intentional bypass of transport security for PII and payment-related workflows is a high-risk flaw.