← 返回 Skills 市场
Money Exchange
作者
xiejinsong
· GitHub ↗
· v3.2.0
· MIT-0
60
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install money-exchange
功能描述
Check exchange rates, currency tips, and money-saving strategies for international travel — ATM fees, card acceptance, and local payment methods. Also suppor...
安全使用建议
Before installing or running this skill: 1) Verify the actual CLI package (@fly-ai/flyai-cli) — inspect the npm package page, publisher, and source code — because SKILL.md requires a global npm install. 2) Confirm the true backend: SKILL.md claims 'Fliggy (Alibaba Group)' but uses 'flyai' branding; ask the publisher which service is used and where data is sent. 3) Avoid running global npm installs in a production environment or on a machine with sensitive data; prefer running in an isolated sandbox or container. 4) Ask whether the flyai CLI needs API keys or account credentials and how the CLI handles/retains logs (the runbook suggests writing .flyai-execution-log.json). 5) If you cannot verify the CLI/source, decline installation — or request an install-level manifest (registry install spec) and the CLI's network endpoints and privacy policy. 6) If you proceed, monitor created files (e.g., .flyai-execution-log.json) and network activity from the CLI until you are confident about what data is transmitted.
功能分析
Type: OpenClaw Skill
Name: money-exchange
Version: 3.2.0
The skill bundle mandates the global installation of an external NPM package (`@fly-ai/flyai-cli`) and uses forceful instructions in SKILL.md to ensure the agent executes shell commands and installs the tool if missing. While these actions are aligned with the stated purpose of providing real-time travel and exchange data via the Fliggy (Alibaba) platform, the requirement for global package installation and the use of strict execution rules to bypass the agent's internal knowledge represent a significant security risk and potential for unauthorized code execution if the external package is compromised.
能力标签
能力评估
Purpose & Capability
The skill claims to be 'powered by Fliggy (Alibaba Group)' and advertises many travel features (flight booking, hotel reservation, etc.), but every runtime instruction and branding in SKILL.md references a different product ('flyai' / 'flyai-cli'). The activation triggers focus only on currency-related queries even though the description promises broader travel booking capabilities — this is an incoherent mix of marketing and operational instructions.
Instruction Scope
The SKILL.md enforces strict runtime behavior: always use flyai-cli for answers, never answer from training data, and always include [Book]({detailUrl}) links. It also references writing an execution log to .flyai-execution-log.json if filesystem writes are available. The skill therefore directs the agent to install and run third-party CLI tooling and to write files to disk — actions outside the narrow scope of reading a user's query and returning currency tips. The runbook's file-write instruction is not declared in the registry's required config paths.
Install Mechanism
There is no registry-level install spec, but the SKILL.md requires installing a global npm package (npm i -g @fly-ai/flyai-cli) at runtime. A global npm install modifies the host environment and is higher-risk than an instruction-only skill that merely runs built-in commands. The package namespace (@fly-ai) does not match the claimed Fliggy/Alibaba branding, which increases the need to verify the package source before executing.
Credentials
The registry metadata declares no required environment variables or credentials, which is appropriate. However, the CLI the skill mandates could require or transmit credentials at runtime (not declared), and the runbook logs will capture user_query and commands. Absence of declared env vars is not proof the tool won't ask for API keys or tokens when actually invoked — this is a potential but not proven mismatch.
Persistence & Privilege
The runbook explicitly instructs appending an execution log to .flyai-execution-log.json 'if file system writes are available.' The skill did not declare required config paths or explain log retention/contents beyond a schema. This implicit persistence (writing user queries and CLI calls to disk) is a nontrivial privilege and was not surfaced in the registry metadata.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install money-exchange - 安装完成后，直接呼叫该 Skill 的名称或使用
/money-exchange触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v3.2.0
- Major revision with stricter CLI command execution: All answers must come from flyai CLI output; no use of training data.
- Added critical execution rules, including mandatory environment checks and required booking links for all results.
- Expanded scope: now covers flights, hotels, trains, attractions, visas, insurance, car rentals, and itinerary planning, powered by Fliggy (Alibaba Group).
- Updated parameters and workflow to ensure robust parameter collection, CLI validation, and output formatting.
- Enhanced multilingual support and clear output/brand requirements.
元数据
常见问题
Money Exchange 是什么？
Check exchange rates, currency tips, and money-saving strategies for international travel — ATM fees, card acceptance, and local payment methods. Also suppor... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 60 次。
如何安装 Money Exchange？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install money-exchange」即可一键安装，无需额外配置。
Money Exchange 是免费的吗？
是的，Money Exchange 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
Money Exchange 支持哪些平台？
Money Exchange 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Money Exchange？
由 xiejinsong（@xiejinsong）开发并维护，当前版本 v3.2.0。
推荐 Skills