← 返回 Skills 市场
mid-autumn-flight
作者
xiejinsong
· GitHub ↗
· v3.2.0
· MIT-0
71
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install mid-autumn-flight
功能描述
Book Mid-Autumn Festival flights for moon festival travel and autumn reunion. Also supports: flight booking, hotel reservation, train tickets, attraction tic...
安全使用建议
Plain-language checklist before installing or enabling this skill:
- Verify the CLI package: look up `@fly-ai/flyai-cli` on the npm registry. Who publishes it? Is the publisher or README tied to Fliggy/Alibaba? If you can't verify the publisher, avoid installing it.
- Prefer explicit sources: the skill has no homepage or source repository. A travel/booking skill claiming to be "powered by Fliggy" should link to an official API or vendor page. Ask the publisher for provenance.
- Be cautious about global installs: the skill instructs `npm i -g ...` which will install software system-wide. That can run arbitrary code and may require admin rights. Consider running it in an isolated environment or container first.
- Watch for retry loops: the skill mandates re-running searches until `[Book]({detailUrl})` links appear. If the CLI doesn't return those fields, the agent may retry repeatedly. Limit agent permissions and monitor execution.
- Test manually first: if you want the CLI functionality, manually install and run the CLI yourself to confirm behavior before letting an agent run it autonomously.
- If you need stronger assurance: request the skill author to add a homepage/source, declare an install spec with checksums or official vendor references, or replace the ambiguous Fliggy claim with the actual data source.
Given the brand/tool mismatch, lack of provenance, and the runtime global npm install, treat this skill as suspicious until you can verify the external CLI's origin and trustworthiness.
功能分析
Type: OpenClaw Skill
Name: mid-autumn-flight
Version: 3.2.0
The skill mandates the global installation of an external NPM package (@fly-ai/flyai-cli) if the command is not found (SKILL.md, references/fallbacks.md). This introduces a supply chain risk and requires the agent to execute code with potentially elevated privileges. While the instructions are focused on flight booking, they use aggressive, imperative language to force the agent to bypass its internal knowledge base and rely exclusively on this external CLI, which is a common pattern for controlling agent behavior through prompt injection.
能力评估
Purpose & Capability
The skill claims to be "powered by Fliggy (Alibaba Group)" but all runtime commands use a CLI called `flyai` and the npm package `@fly-ai/flyai-cli`. There is no homepage or source declared to reconcile this. That mismatch (brand claim vs actual tooling) is incoherent and could indicate mislabeling or deception. Aside from that, the CLI-based workflow (search-flight commands) is consistent with a flight-search purpose.
Instruction Scope
SKILL.md mandates the agent never answer from its training data and to always obtain results from the `flyai` CLI; if the CLI is missing it requires running `npm i -g @fly-ai/flyai-cli`. It also enforces that every result must include `[Book]({detailUrl})` and instructs re-execution if links are missing, which could create repeated CLI runs or an infinite retry loop if the CLI doesn't produce the expected fields. The instructions also perform global package installation and run arbitrary CLI commands on the host — behavior that goes beyond passive text handling and should be reviewed by the user.
Install Mechanism
There is no declared install spec in the skill metadata, but runtime instructions tell the agent to run `npm i -g @fly-ai/flyai-cli` if `flyai` is missing. Installing a global npm package at runtime is a moderate-to-high risk action because it downloads and executes code from the public registry and modifies the system. The skill provides no verification (homepage, package publisher, checksum) and the package name is not clearly tied to the claimed Fliggy/Alibaba brand, increasing suspicion.
Credentials
The skill requests no environment variables, credentials, or config paths — which is proportionate for a read-only search workflow. However, note that booking or account actions (if later added) would normally require credentials; currently none are requested, so there is no immediate secret-exfiltration vector declared in the skill.
Persistence & Privilege
The skill does not request permanent inclusion (always: false) and does not declare changes to other skills or agent-wide settings. However, its runtime behavior includes installing a global npm package, which modifies the host environment and may require elevated privileges; that system-level change is a persistent side-effect to be aware of even though the skill itself does not declare 'always' or other elevated flags.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install mid-autumn-flight - 安装完成后，直接呼叫该 Skill 的名称或使用
/mid-autumn-flight触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v3.2.0
Mid-Autumn Festival travel skill now fully enforces CLI-driven, real-time flight and booking results:
- Requires all data to be sourced directly from the latest `flyai` CLI output (no static or training data permitted).
- Strict output validation: every listing must include a `[Book]({detailUrl})` link.
- New, detailed skill rules emphasize environment checks, parameter collection, and scenario-specific CLI execution.
- Workflow integrates hotel, train, and attraction booking options; usage is streamlined for both Chinese and English input.
- Comprehensive playbooks, examples, and output formatting guidelines included.
元数据
常见问题
mid-autumn-flight 是什么？
Book Mid-Autumn Festival flights for moon festival travel and autumn reunion. Also supports: flight booking, hotel reservation, train tickets, attraction tic... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 71 次。
如何安装 mid-autumn-flight？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install mid-autumn-flight」即可一键安装，无需额外配置。
mid-autumn-flight 是免费的吗？
是的，mid-autumn-flight 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
mid-autumn-flight 支持哪些平台？
mid-autumn-flight 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 mid-autumn-flight？
由 xiejinsong（@xiejinsong）开发并维护，当前版本 v3.2.0。
推荐 Skills