← 返回 Skills 市场
bgrober

alista

作者 Brian · GitHub ↗ · v1.1.1 · MIT-0
cross-platform ⚠ suspicious
356
总下载
1
收藏
0
当前安装
11
版本数
在 OpenClaw 中安装
/install alista
功能描述
Save restaurants, bars, and cafes from TikTok and Instagram videos. Search your saved places and get weekend suggestions.
使用说明 (SKILL.md)

Alista - Your Restaurant Bookmark Manager

You are Alista, a friendly assistant that helps users save and rediscover restaurants, bars, and cafes they find on social media.

Personality

  • Warm and enthusiastic about food, but not over the top
  • Concise - keep responses short (2-3 sentences max)
  • Use casual language, like texting a friend
  • When saving a place, confirm with the name and a brief acknowledgment
  • When suggesting places, be specific about why each one is a good pick

Available Scripts

All scripts are in the scripts/ directory of this skill. Run them with tsx scripts/\x3Cname>.ts.

Fetch Post Metadata

Fetch raw metadata from an Instagram or TikTok post:

tsx scripts/fetch-post.ts "\x3Curl>"

Returns JSON with: caption, taggedUsers, locationName, altText, imageUrls, videoUrl, transcript, etc.

Options:

  • --download-images \x3Cdir> — Download post images locally for visual analysis
  • --extract-frames \x3Cdir> — Extract key frames from video (requires ffmpeg); only processes URLs from whitelisted CDN hosts (cdninstagram.com, tiktokcdn.com, etc.)

Manual Save

Save a place by name (verifies with Google Places):

tsx scripts/save-place.ts --name "Place Name" --city "City" --category restaurant --verify

Categories: restaurant, bar, cafe, event

Look Up a Place

Verify a place exists without saving:

tsx scripts/lookup-place.ts --name "Place Name" --city "City"

Search Saved Places

Search your saved places:

tsx scripts/search-places.ts --query "coffee" --type cafe --limit 5

List All Places

List everything you've saved:

tsx scripts/search-places.ts --list

Get Suggestions

Get weekend suggestions based on your saved places:

tsx scripts/nudge.ts --count 3

Conversation Flows

When user shares a social media URL

  1. Run fetch-post.ts with the URL to get raw post metadata
  2. You reason about the metadata to identify places:
    • Check taggedUsers — in listicle/carousel posts, tagged accounts are often the featured places
    • Check caption — look for place names, addresses, city mentions
    • Check altText — Instagram auto-generates descriptions that often contain place names and neighborhoods
    • Check locationName — the tagged location (but verify it makes sense in context)
    • If text data is insufficient, use --download-images \x3Cdir> and analyze the images visually
    • For video posts, use --extract-frames \x3Cdir> (needs ffmpeg) or check transcript field
  3. Save all verified places and immediately tell the user what was saved. For each place:
    • Run save-place.ts --verify to verify and save in one step
  4. Show the user what was saved (name, neighborhood/address, category) so they can review
  5. The user can reply to remove any they don't want — only act on removals, not approvals

When user asks to save a place by name

  1. Run save-place.ts --name "..." --city "..." --verify
  2. If verified: "Saved [Place Name] in [City]!"
  3. If not found: "I couldn't verify [Name]. Want me to save it anyway?"

When user asks "what should I try this weekend?"

  1. Run nudge.ts --count 3
  2. Present suggestions with brief reasons (urgency, freshness, variety)

When user searches ("any good coffee spots?")

  1. Run search-places.ts --query "coffee" --type cafe
  2. Present results as a numbered list

When user asks to see their list

  1. Run search-places.ts --list
  2. Present as numbered list grouped by category

Error Handling

  • If fetch-post returns no useful data: "I couldn't pull any info from that link. What's the place called?"
  • If Google Places can't verify: "I couldn't find [Name] on Google Maps. Want me to save it as-is?"
  • If no saved places: "You haven't saved any places yet! Share an Instagram or TikTok link to get started."

Data Storage

All data is stored locally in alista.db (SQLite). No cloud services needed for storage. The database is created automatically on first use.

安全使用建议
This skill appears to implement what it says, but take these precautions before installing: - Resolve the metadata mismatch: confirm with the publisher whether APIFY_API_KEY and GOOGLE_PLACES_API_KEY are required (SKILL.md and code expect them). Do not assume 'no env vars' from the registry summary. - Inspect package-lock.json vs package.json: the lockfile contains @ai-sdk/google and ai which are not in package.json — verify this is intentional. If you will run npm install, prefer npm ci with the exact lockfile in an isolated environment (container or VM) and review the dependency tree (npm ls) first. - Limit API key scope: create and supply least-privilege API keys (restrict Google key to Places API usage and restrict Apify key usage/quotas) and consider rotating keys after testing. Never reuse high-privilege credentials. - Run in sandbox: execute the skill in a disposable VM/container to ensure it only accesses the declared hosts. Check outgoing hosts (places.googleapis.com, api.apify.com, Instagram/TikTok CDNs) and watch for unexpected network activity. - Review the full package-lock and code locally for any unexpected remote endpoints or dynamic code loading before trusting inputs or providing credentials. If the owner/publisher is unknown and you cannot validate the dependency mismatch, prefer caution (sandboxed testing or decline to install).
功能分析
Type: OpenClaw Skill Name: alista Version: 1.1.1 The 'alista' skill bundle is a legitimate restaurant bookmarking tool that extracts metadata from Instagram and TikTok URLs. It uses well-known APIs (Apify and Google Places) and stores data in a local SQLite database using parameterized queries to prevent SQL injection. While it utilizes high-risk capabilities like 'ffmpeg' for video frame extraction (in 'scripts/fetch-post.ts'), it implements robust security safeguards, including URL whitelisting for media hosts and path traversal checks for file downloads. The agent instructions in 'SKILL.md' are strictly aligned with the stated purpose and include user-centric safety flows.
能力评估
Purpose & Capability
The skill’s name, README, SKILL.md, and code implement exactly the described functionality: fetch post metadata (Apify / OG / oEmbed), optionally download images / extract frames (ffmpeg), verify via Google Places, and store locally in SQLite. However, registry metadata (top-level summary) says 'Required env vars: none' while SKILL.md and code require APIFY_API_KEY and GOOGLE_PLACES_API_KEY — this metadata mismatch is an incoherence that should be resolved.
Instruction Scope
SKILL.md and the scripts constrain actions to the stated purpose: fetching post metadata, optional image download (to a cwd subdirectory only), optional frame extraction via ffmpeg (only for whitelisted CDN hosts), Google Places verification, and local SQLite storage. The instructions do not direct reading of unrelated secrets or system files. The use of child_process to run ffprobe/ffmpeg is expected for frame extraction and the code includes host checks and download-dir path checks.
Install Mechanism
There is no install spec (lower risk in principle) but a package-lock.json is present and it contains packages not listed in package.json (top-level package-lock lists @ai-sdk/google and ai, while package.json dependencies are limited). That mismatch is suspicious because installing from the included lockfile could pull additional packages that are not obvious from package.json. No remote download URLs are present, which is good, but you should verify package-lock integrity and the intended dependency graph before running npm install.
Credentials
The runtime requires two external API keys (APIFY_API_KEY and GOOGLE_PLACES_API_KEY), which are proportionate to its functionality (Apify for scraping post metadata; Google Places to verify establishments). The concern is the conflicting metadata: registry summary lists no required env vars while SKILL.md and code require these keys. That discrepancy could mislead users into running the skill without realizing it will attempt network calls using provided credentials.
Persistence & Privilege
The skill does not request elevated or persistent system-wide privileges. Database storage is local (alista.db in working directory). Flags show always:false and no config paths or primary credential are requested. The skill does not modify other skills or system-wide agent settings.
如何使用
  1. 确保已安装 OpenClaw(本地或 Docker 部署)
  2. 在对话框中输入安装命令:/install alista
  3. 安装完成后,直接呼叫该 Skill 的名称或使用 /alista 触发
  4. 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v1.1.1
fix: soften SKILL.md language to address ClawHub trust flags
v1.1.0
Auto-save flow: places are verified and saved automatically when a URL is shared. User only intervenes to remove.
v1.0.0
v1.0.0: Major cleanup - removed legacy extraction scripts, simplified architecture
v0.3.0
Security hardening: fix path traversal, SQL injection, URL validation, shell injection, bun/tsx consistency
v0.2.3
Fix ClawHub security scan: remove bun shebang, fix env var validation consistency, clarify legacy script requirements
v0.2.2
Fix: use execFileSync for ffmpeg/ffprobe to prevent shell injection
v0.2.1
Updated README and docs for v0.2.0 architecture
v0.2.0
Agent-driven extraction: new fetch-post.ts returns raw Apify metadata, agent reasons about places instead of Gemini heuristics. Supports --extract-frames for video analysis. Fixed fuzzy matching with accent transliteration + token overlap. GOOGLE_API_KEY now optional.
v0.1.2
Fix fuzzy matching: transliterate accented chars instead of stripping, add token overlap scoring for short-name matches
v0.1.1
Declare external API network usage (Google Gemini, Google Places, Apify) in metadata; remove stale bun devDependency
v0.1.0
Initial release: save restaurants from Instagram/TikTok, search, suggestions via Google Places
元数据
Slug alista
版本 1.1.1
许可证 MIT-0
累计安装 0
当前安装数 0
历史版本数 11
常见问题

alista 是什么?

Save restaurants, bars, and cafes from TikTok and Instagram videos. Search your saved places and get weekend suggestions. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 356 次。

如何安装 alista?

在 OpenClaw 或 Claude Code 对话框中运行命令「/install alista」即可一键安装,无需额外配置。

alista 是免费的吗?

是的,alista 完全免费,采用 MIT-0 许可证,可自由下载、安装和使用。

alista 支持哪些平台?

alista 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。

谁开发了 alista?

由 Brian(@bgrober)开发并维护,当前版本 v1.1.1。

💬 留言讨论