Umy Hotel

An out-of-the-box hotel search skill powered by Umy MCP.

This skill advertises strict PII filtering and 'no executable code' but includes a runnable CLI that will send parameters to external endpoints. Before installing or running it, consider: 1) Do not paste or send personal data (names, phone numbers, emails, IDs) into queries — the skill's filtering is advisory, not enforced in the bundled script. 2) Inspect the script yourself or run it in an isolated environment; it calls https://api.umy.com/v1 and will include X-API-Key (falls back to the public key). 3) Ask the publisher to clarify the MCP vs API endpoint mismatch and why SKILL.md says no executable code. 4) If you want stronger guarantees, only use a version that either contains no executables or whose code you have reviewed and that enforces PII removal client-side. 5) If you set UMY_API_KEY in your environment, be aware the script will use it; keep any custom key secret and limited in scope.

Type: OpenClaw Skill Name: umy-hotel Version: 1.1.0 The Umy Hotel Search skill is a legitimate tool for searching hotels via the Umy MCP API. The skill includes explicit privacy-preserving instructions in SKILL.md and search-hotels.md, directing the AI agent to strip personally identifiable information (PII) from queries before transmission. The implementation in scripts/umy_hotel_tool.mjs uses standard Node.js fetch calls to a disclosed API endpoint (api.umy.com) and contains no evidence of malicious execution, data exfiltration, or obfuscation.