Trip.com TripGenie

TripGenie skill — handles hotel booking, flight search, attraction recommendation and travel consultation

This skill appears to be a straightforward Trip.com TripGenie adapter that requires a single API key (TRIPGENIE_API_KEY) and forwards user queries to TripGenie's API endpoint. Before installing, consider: 1) Verify the endpoint (https://tripgenie-openclaw-prod.trip.com) and the TripGenie onboarding URL are legitimate and that you obtained the API key from the official Trip.com source. 2) The skill will return API responses verbatim by default — those responses may include booking links, reservation tokens, or other sensitive details; only use it if you’re comfortable exposing that raw data to the agent/user. 3) The instructions reference the LANG environment variable but do not declare it; if your environment exposes LANG to the agent, the skill may read it. 4) The metadata doesn't mark the TRIPGENIE_API_KEY as the primary credential — confirm how the platform will store and protect the key. 5) Because the agent can invoke the skill autonomously by default, it may attempt to handle travel queries without explicit user approval; if you want tighter control, disable autonomous invocation or restrict when the skill can be used. If you need higher assurance, ask the skill author for canonical documentation or a signed package/source to confirm origin and behavior.

Type: OpenClaw Skill Name: tcom-tripgenie-skill Version: 0.1.2 The TripGenie skill is a standard API wrapper for Trip.com travel services, facilitating hotel and flight searches. It uses shell commands (curl, jq) to interact with a legitimate-appearing API endpoint (tripgenie-openclaw-prod.trip.com) and requires a specific environment variable (TRIPGENIE_API_KEY) for authentication. No evidence of data exfiltration, unauthorized command execution, or malicious prompt injection was found in SKILL.md or _meta.json.