途牛旅游CLI技能

途牛旅行统一助手（推荐优先使用）- 通过 tuniu CLI 统一调用机票、酒店、门票、火车票、邮轮、度假产品等旅行服务。适用于用户询问航班、酒店、景点门票、火车票、邮轮以及跟团游、自助游、自驾游等度假相关需求的场景。【优先级说明】当同时安装了 tuniu-flight/tuniu-hotel/tuniu-tic...

This skill appears to be a wrapper around the official tuniu CLI and will run shell commands that contact openapi.tuniu.cn and send booking PII to Tuniu. Before installing: (1) Confirm the registry metadata matches SKILL.md — ensure TUNIU_API_KEY is declared where you configure the skill (the manifest shown earlier omitted it). (2) Only install tuniu-cli from a trusted source (npm official package or vendor instructions). (3) Prepare a TUNIU_API_KEY with minimal scope and treat it as a secret; avoid pasting long-lived credentials into logs. (4) Be aware that booking operations will transmit user PII to Tuniu; if that is not acceptable, disable booking flows. (5) If you need greater assurance, ask the publisher to fix the manifest mismatch (declare required env vars consistently) or provide a signed/homepage/source link so you can verify the CLI binary's provenance.

Type: OpenClaw Skill Name: tuniu-cli Version: 1.0.4 The skill functions as a Tuniu travel assistant that executes commands via the `tuniu-cli` using shell execution, which is a high-risk capability. It handles sensitive personally identifiable information (PII), such as passenger names and ID numbers, and includes a 'dynamic discovery' feature that fetches remote service definitions from `https://openapi.tuniu.cn`. While these capabilities are aligned with the stated travel-booking purpose, the instruction to pass JSON arguments within single quotes in a shell command (`tuniu call ... -a '<JSON>'`) without explicit sanitization guidance creates a significant shell injection surface, fitting the criteria for a suspicious classification due to inherent architectural vulnerabilities.