← Back to Skills Marketplace
Top Attractions
by
dingtom336-gif
· GitHub ↗
· v3.2.0
· MIT-0
62
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install top-attractions
Description
Discover the most popular and highest-rated attractions in any city. Shows top-tier POIs with ticket prices, opening hours, and booking links. Also supports:...
Usage Guidance
This skill is suspicious but not obviously malicious. Before installing or enabling it: 1) Verify the source of the '@fly-ai/flyai-cli' package on npm (inspect the package code, maintainer, and recent releases). 2) Ask the skill author for a homepage or vendor contact and clarification about the Fliggy claim and how bookings/authentication work. 3) If you must try it, run the CLI install and skill in a sandboxed environment (container or VM) and review any files it writes (e.g., .flyai-execution-log.json). 4) Consider disabling autonomous invocation unless you trust the CLI package and want the agent to run networked commands without prompting.
Capability Analysis
Type: OpenClaw Skill
Name: top-attractions
Version: 3.2.0
The skill bundle instructs the AI agent to automatically perform a global installation of an external NPM package (`@fly-ai/flyai-cli`) if it is missing, which is a high-privilege system modification. Additionally, `references/runbook.md` directs the agent to log user queries and execution metadata to a local hidden file (`.flyai-execution-log.json`). While these behaviors are plausibly linked to the stated travel-search functionality, the automated software installation and local data persistence represent significant security and privacy risks.
Capability Assessment
Purpose & Capability
The description claims 'Powered by Fliggy (Alibaba Group)' and broad support (flights, hotels, insurance, etc.), but the instructions only call a third-party CLI 'flyai' and show POI search commands. There is no homepage or vendor info, and no declared credentials for Fliggy. The Fliggy branding vs 'flyai' CLI is a mismatch and the broader claimed capabilities are not justified by the provided commands.
Instruction Scope
Runtime instructions strictly require running the flyai CLI and forbids using training data. They do not instruct reading arbitrary system files, but the runbook suggests creating/writing .flyai-execution-log.json containing the raw user_query and CLI call logs, which could persist sensitive user input. The instructions also insist on re-executing until every result includes a [Book]({detailUrl}) link — this enforces repeated network/CLI calls.
Install Mechanism
The skill has no registry install spec but instructs the agent to run 'npm i -g @fly-ai/flyai-cli'. Installing a global npm package is a moderate-risk operation (downloads and executes third-party code). The package name is not a well-known vendor in the manifest, and no checksum or verified release source is provided — verify the npm package and its code before installing.
Credentials
The skill declares no required credentials or env vars, yet promises booking links and other transactional features. It may rely entirely on the external CLI for auth, but that is unspecified. The lack of declared credentials is not necessarily malicious, but combined with unknown CLI provenance and Fliggy branding inconsistency it warrants caution.
Persistence & Privilege
always:false and no system-wide privileges are requested. However, the runbook explicitly suggests appending logs to .flyai-execution-log.json in the working directory, which gives the skill write persistence in the user's environment and may store user-provided queries. This is limited but should be considered before granting autonomous invocation.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install top-attractions - After installation, invoke the skill by name or use
/top-attractions - Provide required inputs per the skill's parameter spec and get structured output
Version History
v3.2.0
top-attractions v3.2.0 Changelog
- Major rewrite of SKILL.md to emphasize CLI-only execution and strict usage of the flyai command.
- Added detailed critical execution rules: never answer with training data, always install/verify flyai-cli, must show booking links.
- Clarified English and Chinese language handling according to user query.
- Expanded playbooks and scenario triggers for broader coverage (top rated, category, kid-friendly, etc.).
- Introduced strict output validation and formatting requirements, including markdown comparison tables and booking links.
- Updated compatibility notes and reference file usage.
Metadata
Frequently Asked Questions
What is Top Attractions?
Discover the most popular and highest-rated attractions in any city. Shows top-tier POIs with ticket prices, opening hours, and booking links. Also supports:... It is an AI Agent Skill for Claude Code / OpenClaw, with 62 downloads so far.
How do I install Top Attractions?
Run "/install top-attractions" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Top Attractions free?
Yes, Top Attractions is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Top Attractions support?
Top Attractions is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Top Attractions?
It is built and maintained by dingtom336-gif (@dingtom336-gif); the current version is v3.2.0.
More Skills