← Back to Skills Marketplace
Photo Spots
by
xiejinsong
· GitHub ↗
· v3.2.0
· MIT-0
73
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install photo-spots
Description
Find the most photogenic and instagrammable spots — iconic viewpoints, colorful streets, architectural marvels, and hidden gems for your social media. Also s...
Usage Guidance
This skill appears to implement a real-time CLI-driven workflow for finding and booking photo spots, but there are several things to verify before installing or using it:
- Confirm the origin and trustworthiness of the npm package @fly-ai/flyai-cli before running npm i -g. Check the package page, owner, downloads, repository, and recent code/maintainer activity. A malicious npm package can execute arbitrary code on install or runtime.
- Ask the publisher to explain the discrepancy between the claimed provider (Fliggy / Alibaba) and the flyai CLI implementation. Who operates the CLI and how does it integrate with Fliggy or other booking providers?
- Be cautious about providing sensitive personal data (passport, payment details) via this skill: the runbook indicates logs may be written to .flyai-execution-log.json containing raw user_query and CLI results. If you must use the skill, run it in a sandboxed environment or ensure logs are stored securely and redacted.
- Because the skill enforces "only use CLI output" and requires including booking links, it may cause repeated network calls; monitor network activity and rate/loop behavior during initial use.
If you cannot validate the npm package origin and the provider relationship, treat this skill as untrusted and avoid installing it. If you proceed, limit exposure by testing in an isolated environment and avoid entering payment- or identity-sensitive information until you confirm how auth and logging are handled.
Capability Analysis
Type: OpenClaw Skill
Name: photo-spots
Version: 3.2.0
The skill requires high-risk behaviors including the mandatory global installation of an external NPM package (@fly-ai/flyai-cli) and the execution of shell commands for network-dependent tasks in SKILL.md. While these capabilities are plausibly needed for the stated purpose of retrieving real-time travel data, the requirement for elevated privileges (npm -g) and the instruction to maintain a local execution log in references/runbook.md constitute significant security risks without a verified trust chain for the external CLI tool.
Capability Assessment
Purpose & Capability
The skill claims travel booking features powered by 'Fliggy (Alibaba Group)' but the runtime requires installing and using an npm CLI package named @fly-ai/flyai-cli. That provider/implementation mismatch is unexplained. Requiring a third‑party CLI to deliver bookings and real‑time pricing is plausible, but the SKILL.md does not document the relationship between 'flyai' and Fliggy or why no API keys/credentials are needed for booking & payment operations.
Instruction Scope
The SKILL.md forces the agent to always obtain data from the flyai CLI (never use training data) and to re-run until every result includes a [Book]({detailUrl}) link, which could cause repeated command execution. The runbook also includes an optional filesystem write (.flyai-execution-log.json) containing raw user_query and CLI call logs — this means the skill instructs the agent to persist potentially sensitive user input. The file manifests and references contain no hidden endpoints, but the strict "only CLI" rule + mandatory global install broaden the agent's runtime actions beyond simple read-only lookups.
Install Mechanism
There is no formal install spec in the registry metadata; the SKILL.md tells the agent to run npm i -g @fly-ai/flyai-cli. Installing a global npm package is a common pattern but brings moderate risk because arbitrary code will be installed and run. The manifest provides no homepage, source, or publisher information to validate the package identity. No URL or checksum is provided to verify the package authenticity.
Credentials
The skill requests no environment variables or credentials in metadata, which is coherent on the surface. However the skill claims full booking/ticketing/payment capabilities without declaring any credentials or payment integration details; the flyai CLI may prompt for credentials or handle auth internally, but that is not documented. Also, the runbook indicates logging of user queries which may include personal data — this is a proportionality/privacy concern.
Persistence & Privilege
always:false and no special platform privileges are requested. However, the runbook instructs the agent to append execution logs to a local file (.flyai-execution-log.json) if filesystem writes are available, which grants persistent storage of raw queries and CLI responses. The skill does not claim to modify other skills or system-wide settings, but the logging behavior should be considered persistent and potentially sensitive.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install photo-spots - After installation, invoke the skill by name or use
/photo-spots - Provide required inputs per the skill's parameter spec and get structured output
Version History
v3.2.0
photo-spots v3.2.0
- Updated SKILL.md with strict CLI-only execution rules: data MUST come from flyai CLI output.
- Added multi-language support and output requirements based on user's input language (Chinese or English).
- Enforced that each attraction result must include a `[Book]({detailUrl})` link to ensure all info is sourced from flyai.
- Expanded supported travel services (flights, hotels, tickets, insurance, car rental, etc.), all via Fliggy.
- Detailed scenario playbooks and output formatting rules for improved accuracy and consistency.
- Clarified activation/trigger conditions and restricted responses to matching travel photography queries only.
Metadata
Frequently Asked Questions
What is Photo Spots?
Find the most photogenic and instagrammable spots — iconic viewpoints, colorful streets, architectural marvels, and hidden gems for your social media. Also s... It is an AI Agent Skill for Claude Code / OpenClaw, with 73 downloads so far.
How do I install Photo Spots?
Run "/install photo-spots" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Photo Spots free?
Yes, Photo Spots is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Photo Spots support?
Photo Spots is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Photo Spots?
It is built and maintained by xiejinsong (@xiejinsong); the current version is v3.2.0.
More Skills