travel-blind-box

真正的盲盒旅行规划器！用户只需提供当前位置、出发日期、天数和预算，自动推荐未去过的目的地并生成轻松行程。使用 flyai skill 查询实时信息，支持历史记录管理避免重复。主打新奇体验和随意放松。

This skill appears coherent with its travel-planner description, but consider these before installing: 1) The skill stores travel history and generated itineraries under ~/.qoderwork/travel-blind-box/ (history.json and output files). Those files can contain sensitive info (visited cities, booking confirmation numbers). Inspect or back up that directory and confirm you consent to local storage. 2) The SKILL.md instructs calls to a third-party 'flyai' skill for live data; using the skill will send your current city, dates, budget and the visited-cities list to that external skill — verify you trust flyai or avoid sending sensitive details. 3) Scripts run locally (Python). If you want extra safety, review the included .py files in a text editor or run the skill in a restricted/sandboxed environment. 4) The import_history feature can merge external history files — only import trusted files. If you prefer not to persist history, you can remove or inspect history.json (path documented in README) or run the skill in a temporary environment. Overall the package is internally consistent and not requesting unrelated credentials, but be mindful of local data persistence and external data sharing.

Type: OpenClaw Skill Name: travel-blind-box Version: 1.0.0 The travel-blind-box skill bundle is a comprehensive travel planning tool that uses local Python scripts to manage travel history, allocate budgets, and generate itineraries. The code logic in scripts like `history_manager.py` and `budget_allocator.py` is transparent and aligns with the stated purpose of providing a 'blind box' travel experience. While `SKILL.md` contains a hardcoded output path (`/Users/haoxuan/...`), this appears to be a non-malicious development artifact. The skill relies on the external `flyai` tool for real-time data, and no evidence of data exfiltration, unauthorized execution, or malicious prompt injection was found.