← 返回 Skills 市场
mountain-hotel
作者
xiejinsong
· GitHub ↗
· v3.2.0
· MIT-0
62
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install mountain-hotel
功能描述
Book flights to mountain hotels and highland resort destinations. Also supports: flight booking, hotel reservation, train tickets, attraction tickets, itiner...
安全使用建议
This skill is internally inconsistent and asks the agent to install and run an undocumented npm CLI (@fly-ai/flyai-cli) while the description names Fliggy/Alibaba — there is no homepage or declared credentials. Before installing or enabling this skill: 1) verify the origin and trustworthiness of the @fly-ai/flyai-cli package (npm page, publisher, source code repository); 2) ask the skill author to explain the Fliggy vs flyai discrepancy and to provide a homepage or source; 3) confirm whether bookings require API keys and where those credentials are stored (the skill currently declares none); 4) avoid allowing automatic global npm installs on sensitive hosts — run the CLI in a sandbox or review the package code first. If you cannot confirm these points, treat the skill as untrusted.
功能分析
Type: OpenClaw Skill
Name: mountain-hotel
Version: 3.2.0
The skill mandates the automatic global installation of an external npm package (@fly-ai/flyai-cli) if it is missing, as seen in SKILL.md and references/fallbacks.md. This 'auto-install' instruction forces the agent to perform high-privilege system modifications (npm i -g) which could lead to Remote Code Execution (RCE) if the package is compromised or malicious. While the instructions appear aligned with the stated travel-booking purpose, the lack of user confirmation for global software installation is a significant security risk.
能力评估
Purpose & Capability
The description claims Fliggy (Alibaba) as the data provider, but every runtime instruction invokes a separate 'flyai' CLI (@fly-ai/flyai-cli). No homepage or source is provided. Booking/search functionality typically requires credentials or an API endpoint; the skill declares no credentials or config paths. The requested runtime dependency (flyai CLI) does not match the advertised provider (Fliggy), which is a meaningful incoherence.
Instruction Scope
SKILL.md mandates executing the flyai CLI for every response and explicitly directs the agent to install an npm package if the CLI is missing. It forbids answering from training data and requires that every result include a [Book]({detailUrl}) link. These runtime instructions cause the agent to perform network installs and to re-run commands until outputs include booking links, which is scope-expanding and operationally risky (possible loops, network installs, and reliance on an undeclared external binary).
Install Mechanism
Although the registry shows no install spec, the instructions tell the agent to run 'npm i -g @fly-ai/flyai-cli' if flyai is not present. That performs a global install of an npm package from the public registry (package identity and trustworthiness not established here). An instruction-only install like this is higher risk than a skill that declares a vetted install source in metadata.
Credentials
The skill declares no required environment variables or primary credential even though its capabilities include booking and reservations (normally needing API keys/accounts). It's plausible the CLI handles auth interactively or via system config, but the absence of any declared credential requirement is inconsistent and could lead the CLI to request or reuse system credentials implicitly.
Persistence & Privilege
The skill does not request 'always: true' and does not modify other skills. However, its runtime behavior includes a global npm install which changes the host environment (adds a global binary). That is a persistent system change even though it doesn't alter agent config directly.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install mountain-hotel - 安装完成后，直接呼叫该 Skill 的名称或使用
/mountain-hotel触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v3.2.0
- Major update: strict new execution rules and CLI-only answers.
- Only responds to flight/hotel queries using real-time data from the flyai CLI.
- Now requires CLI installation check before every search; never uses training data for answers.
- Output must always include booking links from live CLI responses.
- Improved language detection and stricter parameter handling—never invents values.
- Expanded supported travel features, including train tickets, car rentals, and visa info.
元数据
常见问题
mountain-hotel 是什么？
Book flights to mountain hotels and highland resort destinations. Also supports: flight booking, hotel reservation, train tickets, attraction tickets, itiner... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 62 次。
如何安装 mountain-hotel？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install mountain-hotel」即可一键安装，无需额外配置。
mountain-hotel 是免费的吗？
是的，mountain-hotel 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
mountain-hotel 支持哪些平台？
mountain-hotel 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 mountain-hotel？
由 xiejinsong（@xiejinsong）开发并维护，当前版本 v3.2.0。
推荐 Skills