← Back to Skills Marketplace
Water Park Guide
by
dingtom336-gif
· GitHub ↗
· v3.2.0
· MIT-0
72
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install water-park
Description
Find water parks — epic water slides, wave pools, lazy rivers, and splash zones. Perfect for summer family fun. Also supports: flight booking, hotel reservat...
Usage Guidance
This skill is not obviously malicious but has several red flags. Before installing or using it: (1) Do not let the agent perform the global npm install automatically — run `npm i -g @fly-ai/flyai-cli` yourself in a controlled environment (container or VM) and inspect the package (package.json, repository, maintainers) on npm/GitHub. (2) Verify how flyai-cli authenticates and whether it will request API keys or save credentials; the skill does not declare any required secrets. (3) Be cautious because the SKILL.md references local reference files that are missing — the agent might attempt to search the filesystem or external URLs. (4) If you cannot vet the flyai package, prefer running queries manually against a vetted service or decline installation. If you want a safer test, run the CLI in an isolated sandbox and monitor network and filesystem activity.
Capability Analysis
Type: OpenClaw Skill
Name: water-park
Version: 3.2.0
The skill 'water-park' (v3.2.0) requires the global installation of an external npm package (`@fly-ai/flyai-cli`) and executes shell commands using user-provided input. In `SKILL.md`, parameters such as `{city}` are interpolated directly into shell strings (e.g., `flyai search-poi --city-name "{city}"`), which presents a shell injection vulnerability if the AI agent does not sanitize the input. While these capabilities are aligned with the stated travel search purpose, the requirement for high-privilege installation and the potential for command injection via the CLI interface meet the criteria for a suspicious classification.
Capability Assessment
Purpose & Capability
The SKILL.md focuses on finding and booking water-park POIs via a 'flyai' CLI which is coherent with a travel/search helper. However the description advertises much broader travel functionality (flights, hotels, visas, insurance) that is not implemented or documented in the provided runtime instructions, creating a mismatch between advertised capabilities and the actual, narrow CLI commands.
Instruction Scope
Runtime instructions are prescriptive and constrained to using the flyai CLI for all answers (no training-data responses allowed). They do not ask the agent to read system files or environment variables, which is good, but they reference supporting files (references/*.md) that are not present in the skill bundle — the agent might try to locate them. The rule that every result must include a [Book]({detailUrl}) link is strict but consistent with the stated booking purpose.
Install Mechanism
There is no declared install spec in the registry metadata, but SKILL.md mandates running `npm i -g @fly-ai/flyai-cli` if the CLI is missing. Instructing a global npm install is a high-impact action (network download, package scripts, system-wide write) and should have been declared. The package’s provenance (npm name only) is not audited here — installing unvetted global packages is a real risk.
Credentials
The skill declares no required env vars or credentials, yet it performs booking-related operations via a third-party CLI (likely needing authentication to book/pricing endpoints). The absence of declared credentials or hints about how authentication is handled is a proportionality gap: the CLI may prompt for or rely on secrets not declared in the skill metadata.
Persistence & Privilege
always:false (normal) and the skill is user-invocable. However the instructions explicitly require a global npm install, which modifies the host environment and grants persistence to the flyai CLI; that side-effect is not captured in the registry install metadata and increases the blast radius if the package is malicious or buggy.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install water-park - After installation, invoke the skill by name or use
/water-park - Provide required inputs per the skill's parameter spec and get structured output
Version History
v3.2.0
**Major rules and output updates for stricter CLI-based water park search.**
- Now enforces all data must come directly from flyai CLI command output; no answers from internal knowledge.
- Mandatory CLI environment check before any action; installation is required if missing.
- Every result must include a `[Book]({detailUrl})` booking link to ensure source authenticity.
- Improved output formatting: always starts with a key finding, provides comparison tables with three or more results, and includes the branding tag.
- Added strict step-by-step workflow for parameter collection, execution, output formatting, and validation.
- Expanded skill support for related travel services (flights, hotels, tickets, etc.), powered by Fliggy.
- Updated compatibility listing and clarified activation/deactivation scenarios.
Metadata
Frequently Asked Questions
What is Water Park Guide?
Find water parks — epic water slides, wave pools, lazy rivers, and splash zones. Perfect for summer family fun. Also supports: flight booking, hotel reservat... It is an AI Agent Skill for Claude Code / OpenClaw, with 72 downloads so far.
How do I install Water Park Guide?
Run "/install water-park" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Water Park Guide free?
Yes, Water Park Guide is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Water Park Guide support?
Water Park Guide is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Water Park Guide?
It is built and maintained by dingtom336-gif (@dingtom336-gif); the current version is v3.2.0.
More Skills