← 返回 Skills 市场
marathon-trip
作者
bufferstreamer
· GitHub ↗
· v3.2.0
· MIT-0
70
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install marathon-trip
功能描述
Book flights for marathon and running event trips. Also supports: flight booking, hotel reservation, train tickets, attraction tickets, itinerary planning, v...
安全使用建议
This skill appears to be a CLI-driven flight-booking helper that expects to call a third-party tool (flyai). Before installing or enabling it: 1) Verify the provenance of the @fly-ai/flyai-cli npm package (check npmjs.org, read package source, maintainer, and recent releases); 2) Confirm the claimed provider — the SKILL.md mentions Fliggy (Alibaba) but the CLI is named 'flyai' (this mismatch could be harmless or indicate an impersonation); 3) Be cautious about running 'npm i -g' globally — consider testing in a sandbox or container, since npm packages can run code at install and runtime; 4) If you require guarantees, ask the skill author for a homepage, code repository, or signed release; 5) If you decide to proceed, monitor the network requests and package behavior (and avoid giving unrelated credentials). If the author cannot clarify the Node/npm dependency or provider relationship, treat the skill as untrusted.
功能分析
Type: OpenClaw Skill
Name: marathon-trip
Version: 3.2.0
The skill requires the global installation of an external NPM package (@fly-ai/flyai-cli) and executes shell commands with parameters derived from user input (SKILL.md). While these actions are aligned with the stated purpose of flight booking, the requirement for global installation and the potential for shell injection via unsanitized parameters represent significant security risks. No evidence of intentional malice or data exfiltration was found.
能力评估
Purpose & Capability
The skill claims to book flights/hotels/etc. and its runtime instructions rely entirely on a third-party CLI (flyai). However the skill manifest declares no required binaries or credentials while the instructions require Node/npm and a global npm package (@fly-ai/flyai-cli). This mismatch (manifest says 'none' but SKILL.md instructs installing tooling) is an incoherence that should be resolved. Also the description says 'powered by Fliggy (Alibaba Group)' while the CLI is named 'flyai'—the provider relationship is unclear.
Instruction Scope
The SKILL.md stays within the travel-booking domain: it mandates using the flyai CLI, defines exact commands and parameters, forbids using training data, and requires results to include booking links. It does not instruct reading unrelated files, accessing arbitrary environment variables, or exfiltrating data. The strict 'must use CLI' rules limit scope, but the self-test and re-execution loop give the agent broad autonomy to repeatedly call the CLI.
Install Mechanism
There is no registry install spec, but SKILL.md directly tells the agent to run 'npm i -g @fly-ai/flyai-cli' when flyai isn't present. Installing a global npm package on the fly is a moderate risk: npm packages can execute arbitrary code at install/run time. The skill does not declare this install action in its manifest and provides no canonical source, homepage, or checksum for verification.
Credentials
The skill requests no environment variables, credentials, or config paths in the registry metadata. The actual instructions likewise do not request access to secrets or unrelated credentials. This access level is proportionate to the stated purpose.
Persistence & Privilege
always is false and the skill is user-invocable with normal autonomous invocation allowed. The skill does not ask to modify other skills or system settings. The main persistence concern is the optional global npm install (which would write to system/global npm modules), but that is not an automatic registry install flag—it's an instruction the agent may follow.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install marathon-trip - 安装完成后，直接呼叫该 Skill 的名称或使用
/marathon-trip触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v3.2.0
marathon-trip 3.2.0
- Expanded booking support: Now includes hotel reservation, train tickets, attraction tickets, itinerary planning, visa info, travel insurance, and car rental alongside flights.
- Detailed CLI execution and output validation instructions to ensure all information comes from real-time flyai results.
- New and improved parameter mapping and scenario playbooks for handling various marathon and race day travel queries.
- Enhanced output rules: Conclusion-first answers, comparison tables, and consistent booking links.
- Compatibility expanded to more agents and platforms.
元数据
常见问题
marathon-trip 是什么？
Book flights for marathon and running event trips. Also supports: flight booking, hotel reservation, train tickets, attraction tickets, itinerary planning, v... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 70 次。
如何安装 marathon-trip？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install marathon-trip」即可一键安装，无需额外配置。
marathon-trip 是免费的吗？
是的，marathon-trip 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
marathon-trip 支持哪些平台？
marathon-trip 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 marathon-trip？
由 bufferstreamer（@bufferstreamer）开发并维护，当前版本 v3.2.0。
推荐 Skills