← 返回 Skills 市场
多目的地航线组合比价助手
作者
lushengteng
· GitHub ↗
· v1.0.0
· MIT-0
84
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install multi-city-flight-optimizer
功能描述
多目的地跨城比价航线优化助手，自动收集出行约束（出发地、假期时间窗、候选城市），一键比价筛出最优往返城市组合（更便宜+更少中转/更短飞行），输出Top3方案并给出可玩性建议。触发词：跨城比价、航线优化、机票比价、多城市飞、往返组合、机票怎么买最便宜、帮我搜机票、去程回程怎么选。
安全使用建议
Before installing, confirm these points: (1) Verify whether your agent platform already provides the 'flyai' CLI and the platform tools (search_memory, ask_user_question, fetch_content, create_file). If not, the skill will fail or will require installing unknown binaries. (2) Ask the skill author why every command disables TLS verification (NODE_TLS_REJECT_UNAUTHORIZED=0). Disabling TLS verification is unsafe — do not run commands with this environment variable set unless you understand and accept the risk. (3) Understand privacy: the skill reads and updates Memory (travel origin, preferences, companions). If you care about sensitive data, ask how long that memory is stored and how to opt out. (4) The skill surfaces external booking links (jumpUrl). Treat these like any external link — verify destination before clicking. (5) If you decide to proceed, run the skill in a sandboxed environment first (or request a version that does not disable TLS) and verify that the 'flyai' CLI used is the official / trusted implementation. If the author can confirm that the runtime environment already provides flyai and can remove or justify the TLS-disable pattern, the incoherences would be resolved and my confidence would increase.
功能分析
Type: OpenClaw Skill
Name: multi-city-flight-optimizer
Version: 1.0.0
The skill bundle is designed for multi-city flight optimization but contains a significant security risk by explicitly instructing the AI agent to execute shell commands with `NODE_TLS_REJECT_UNAUTHORIZED=0` (found in `SKILL.md`, `reference/flyai-commands.md`, and `reference/tools-guide.md`). This disables SSL/TLS certificate verification, exposing the agent to Man-in-the-Middle (MitM) attacks when interacting with flight search APIs. While this appears to be a functional workaround for environment-specific connectivity issues rather than intentional malice, it represents a high-risk security vulnerability.
能力评估
Purpose & Capability
The skill claims to perform flight searches and scoring — that aligns with the documented commands (flyai search-flight / keyword-search). However, the skill does not declare any required binaries or environment variables even though every core workflow runs the external 'flyai' CLI. Omitting 'flyai' as a required binary is an incoherence: either the platform already provides this binary (not documented here), or the skill will fail or attempt to install/execute an unexpected binary. This mismatch should be clarified.
Instruction Scope
The SKILL.md instructs the agent to: read/update Memory (search_memory / ask_user_question), run many flyai CLI commands in parallel, fetch external content (fetch_content), and create local HTML files (create_file). Those are reasonable for the stated purpose. Two problematic instructions: (1) all example commands prepend NODE_TLS_REJECT_UNAUTHORIZED=0, which disables TLS verification for outgoing HTTPS requests — this weakens security and can enable MITM; (2) the skill expects to surface booking URLs (jumpUrl) which are external links the user may click — the skill does not include any verification or sanitization guidance for these links. Also, the runbook exercises broad discretion (parallel searches, alias fallback, date expansion) but that's within purpose.
Install Mechanism
This is instruction-only (no install spec), which lowers risk. However, it depends heavily on an external CLI ('flyai') and platform tools (search_memory, ask_user_question, fetch_content, create_file). The absence of an install spec is acceptable if the execution environment already provides these tools — but that assumption is not stated in the metadata, which is a documentation/incoherence issue rather than a direct install risk.
Credentials
The skill declares no required environment variables, but the instructions rely on setting NODE_TLS_REJECT_UNAUTHORIZED=0 in command invocations — an environment variable used to disable SSL verification. That environment usage is not declared and is security-reducing. Aside from that, the skill does not request credentials. The skill does read and update user Memory (user profile, preferences) which is expected for personalization but has privacy implications; the skill does not describe retention or opt-out behavior.
Persistence & Privilege
The skill is not 'always: true' and does not request elevated privileges or system-wide configuration changes. It uses Memory to store user preferences (normal for personalization) and creates files in the user's working directory. Autonomous invocation is allowed by default but is not combined with high privilege or persistent self-enablement. No concerning persistence behavior observed.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install multi-city-flight-optimizer - 安装完成后，直接呼叫该 Skill 的名称或使用
/multi-city-flight-optimizer触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
Initial release of Multi-City Flight Optimizer v1.0.0
- Enables multi-city flight price optimization, extracting origin, travel window, destination cities, and user preferences from natural language.
- Automatically compares all possible outbound/inbound city combinations and scores by price, transfer, and flight duration.
- Outputs Top 3 recommended itineraries (overall best, cheapest, fastest) with travel route suggestions and risk alerts.
- Remembers user preferences (origin, transfer, group size, etc.) for smoother future use.
- Interactive Q&A for missing info and ambiguous destinations, plus optional HTML visual plan export for sharing/archiving.
元数据
常见问题
多目的地航线组合比价助手 是什么？
多目的地跨城比价航线优化助手，自动收集出行约束（出发地、假期时间窗、候选城市），一键比价筛出最优往返城市组合（更便宜+更少中转/更短飞行），输出Top3方案并给出可玩性建议。触发词：跨城比价、航线优化、机票比价、多城市飞、往返组合、机票怎么买最便宜、帮我搜机票、去程回程怎么选。 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 84 次。
如何安装 多目的地航线组合比价助手？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install multi-city-flight-optimizer」即可一键安装，无需额外配置。
多目的地航线组合比价助手 是免费的吗？
是的，多目的地航线组合比价助手 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
多目的地航线组合比价助手 支持哪些平台？
多目的地航线组合比价助手 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 多目的地航线组合比价助手？
由 lushengteng（@purelanren）开发并维护，当前版本 v1.0.0。
推荐 Skills