通用商旅出行规划助手

通用商旅出行规划技能 v1.0 · 面向所有商务出差人士。 一站式AI出行规划 + 全平台酒店比价 + HTML报告生成。 集成12306 MCP（火车票实时查询）+ 高德地图（路径规划/POI/天气）+ Web搜索（航班/酒店价格）。 支持**实时HTML报告生成**，所有预订链接真实可一键跳转。 触发条件：...

This skill appears to do what it claims (travel planning with real‑time train/map data and HTML reports), but it instructs the agent to run remote npm packages via `npx -y` at runtime and provides no source/homepage or pinned package versions. Running `npx` like this can execute arbitrary third‑party code on the agent environment. Before installing or enabling: 1) ask the publisher for source code or repository links and for pinned package versions; 2) review the source of packages named (e.g., 12306-mcp, xhs-mcp) yourself or request a vetted release; 3) avoid supplying high‑privilege or unrelated credentials; 4) if you must use it, run in an isolated/sandboxed environment or require explicit approval before the agent executes external packages; 5) prefer an implementation that uses well-known APIs with documented auth flows instead of dynamic npx execution.

Type: OpenClaw Skill Name: universal-travel-planner Version: 2.1.0 The travel planner skill integrates multiple external services but introduces a supply chain vulnerability by using 'npx -y' to execute unpinned MCP packages (12306-mcp, xhs-mcp) as described in SKILL.md. This pattern allows for potential remote code execution if the package names are hijacked or subject to typosquatting. While the behavior aligns with the stated purpose of travel planning and no direct evidence of intentional malice was found, the use of unverified external execution is a high-risk security flaw.