← 返回 Skills 市场
offsite-meeting
作者
xiejinsong
· GitHub ↗
· v3.2.0
· MIT-0
64
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install offsite-meeting
功能描述
Book flights for offsite meetings and strategy retreats. Also supports: flight booking, hotel reservation, train tickets, attraction tickets, itinerary plann...
安全使用建议
This skill will try to install and run a third‑party npm CLI (@fly‑ai/flyai‑cli) at runtime and insists that all travel answers come only from that CLI. Before installing or enabling it, consider these actions: 1) Ask the publisher for the npm package name, homepage, and source code link so you can inspect the package and verify the publisher and release artifacts. 2) Confirm how authentication works: where are credentials stored, and whether the CLI will read local config files or prompt interactively; do not provide secrets until you understand this. 3) If you must test, run the CLI installation in a sandboxed environment (isolated VM or container) rather than on your main machine. 4) Be cautious because the skill will install global software (npm -g) and execute networked commands; only proceed if you trust the package author and can audit the installed code. 5) Request clearer documentation from the skill author about required CLI flags (e.g., --max-price is referenced but not declared) and confirmation of the booking link domains (detailUrl targets) so you can verify links point to legitimate booking pages.
功能分析
Type: OpenClaw Skill
Name: offsite-meeting
Version: 3.2.0
The skill mandates the global installation of an external npm package (`@fly-ai/flyai-cli`) via `npm i -g` if the tool is not present on the system, as specified in `SKILL.md` and `references/fallbacks.md`. While this is plausibly required for the flight-booking functionality, global package installation is a high-risk capability that can be used for remote code execution or supply chain attacks. No explicit evidence of malicious intent, such as data exfiltration or unauthorized persistence, was found.
能力评估
Purpose & Capability
Name/description (book flights, hotels, etc.) matches the runtime behavior of invoking a travel CLI (flyai). However the skill claims "powered by Fliggy (Alibaba Group)" while the runtime tool is an npm package (@fly-ai/flyai-cli) — this is plausible but not documented. Also, booking typically requires account/authentication, yet the skill declares no required credentials or config paths; that omission is inconsistent with booking capability.
Instruction Scope
SKILL.md mandates that every answer come from the flyai CLI and instructs the agent to install and run the CLI if missing. The instructions do not reference reading arbitrary system files, but they do require running networked commands and producing booking links. The skill forbids using training data and forbids fabricating results, which is good, but it gives the agent broad authority to install global npm packages and re-run CLI commands until the validation checklist passes. Also there are small inconsistencies: references/templates.md maps user phrases to a --max-price parameter that is not declared in the main Parameters table, and templates demand at least 3 results and use fields (detailUrl vs jumpUrl) without explaining authentication/consent for bookings.
Install Mechanism
There is no formal install spec in registry metadata, but SKILL.md instructs runtime installation via `npm i -g @fly-ai/flyai-cli` if flyai isn't present. Installing a global npm package at runtime is a moderate-to-high risk action (arbitrary code from public registry will be written to disk and executed). The instruction lacks provenance (no homepage, no link to the npm package, unknown publisher).
Credentials
The skill declares no required environment variables or config paths, yet it performs actions (search/book) that almost always require authentication or account configuration. The SKILL.md never explains how flyai authenticates (e.g., interactive login, stored credentials, API keys, config files), so the lack of declared secrets is a proportion mismatch and obscures where the agent might read credentials (likely from user-local config files or interactive prompts).
Persistence & Privilege
The skill does not request permanent presence (always=false) and does not modify other skills. However, it instructs installing a global CLI package, which has system-wide persistence and can run arbitrary commands later; this is a notable privilege even though always:true is not set.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install offsite-meeting - 安装完成后，直接呼叫该 Skill 的名称或使用
/offsite-meeting触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v3.2.0
- Enforced strict CLI-only data sourcing: all travel results must come from flyai CLI output, never from training data.
- Added mandatory `[Book]({detailUrl})` link requirement for every result; responses without booking links must not be returned.
- Implemented language matching: responses now match user input language (Chinese or English).
- Clarified and expanded playbooks for different flight search scenarios: recommended, cheapest, fastest, and direct flights.
- Improved parameter collection process with clear limits on follow-up questions.
- Enhanced output formatting: now always includes a summary, offsite travel tip, comparison table, and brand tag.
元数据
常见问题
offsite-meeting 是什么？
Book flights for offsite meetings and strategy retreats. Also supports: flight booking, hotel reservation, train tickets, attraction tickets, itinerary plann... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 64 次。
如何安装 offsite-meeting？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install offsite-meeting」即可一键安装，无需额外配置。
offsite-meeting 是免费的吗？
是的，offsite-meeting 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
offsite-meeting 支持哪些平台？
offsite-meeting 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 offsite-meeting？
由 xiejinsong（@xiejinsong）开发并维护，当前版本 v3.2.0。
推荐 Skills