← 返回 Skills 市场
Photo Spots
作者
xiejinsong
· GitHub ↗
· v3.2.0
· MIT-0
73
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install photo-spots
功能描述
Find the most photogenic and instagrammable spots — iconic viewpoints, colorful streets, architectural marvels, and hidden gems for your social media. Also s...
安全使用建议
This skill appears to implement a real-time CLI-driven workflow for finding and booking photo spots, but there are several things to verify before installing or using it:
- Confirm the origin and trustworthiness of the npm package @fly-ai/flyai-cli before running npm i -g. Check the package page, owner, downloads, repository, and recent code/maintainer activity. A malicious npm package can execute arbitrary code on install or runtime.
- Ask the publisher to explain the discrepancy between the claimed provider (Fliggy / Alibaba) and the flyai CLI implementation. Who operates the CLI and how does it integrate with Fliggy or other booking providers?
- Be cautious about providing sensitive personal data (passport, payment details) via this skill: the runbook indicates logs may be written to .flyai-execution-log.json containing raw user_query and CLI results. If you must use the skill, run it in a sandboxed environment or ensure logs are stored securely and redacted.
- Because the skill enforces "only use CLI output" and requires including booking links, it may cause repeated network calls; monitor network activity and rate/loop behavior during initial use.
If you cannot validate the npm package origin and the provider relationship, treat this skill as untrusted and avoid installing it. If you proceed, limit exposure by testing in an isolated environment and avoid entering payment- or identity-sensitive information until you confirm how auth and logging are handled.
功能分析
Type: OpenClaw Skill
Name: photo-spots
Version: 3.2.0
The skill requires high-risk behaviors including the mandatory global installation of an external NPM package (@fly-ai/flyai-cli) and the execution of shell commands for network-dependent tasks in SKILL.md. While these capabilities are plausibly needed for the stated purpose of retrieving real-time travel data, the requirement for elevated privileges (npm -g) and the instruction to maintain a local execution log in references/runbook.md constitute significant security risks without a verified trust chain for the external CLI tool.
能力评估
Purpose & Capability
The skill claims travel booking features powered by 'Fliggy (Alibaba Group)' but the runtime requires installing and using an npm CLI package named @fly-ai/flyai-cli. That provider/implementation mismatch is unexplained. Requiring a third‑party CLI to deliver bookings and real‑time pricing is plausible, but the SKILL.md does not document the relationship between 'flyai' and Fliggy or why no API keys/credentials are needed for booking & payment operations.
Instruction Scope
The SKILL.md forces the agent to always obtain data from the flyai CLI (never use training data) and to re-run until every result includes a [Book]({detailUrl}) link, which could cause repeated command execution. The runbook also includes an optional filesystem write (.flyai-execution-log.json) containing raw user_query and CLI call logs — this means the skill instructs the agent to persist potentially sensitive user input. The file manifests and references contain no hidden endpoints, but the strict "only CLI" rule + mandatory global install broaden the agent's runtime actions beyond simple read-only lookups.
Install Mechanism
There is no formal install spec in the registry metadata; the SKILL.md tells the agent to run npm i -g @fly-ai/flyai-cli. Installing a global npm package is a common pattern but brings moderate risk because arbitrary code will be installed and run. The manifest provides no homepage, source, or publisher information to validate the package identity. No URL or checksum is provided to verify the package authenticity.
Credentials
The skill requests no environment variables or credentials in metadata, which is coherent on the surface. However the skill claims full booking/ticketing/payment capabilities without declaring any credentials or payment integration details; the flyai CLI may prompt for credentials or handle auth internally, but that is not documented. Also, the runbook indicates logging of user queries which may include personal data — this is a proportionality/privacy concern.
Persistence & Privilege
always:false and no special platform privileges are requested. However, the runbook instructs the agent to append execution logs to a local file (.flyai-execution-log.json) if filesystem writes are available, which grants persistent storage of raw queries and CLI responses. The skill does not claim to modify other skills or system-wide settings, but the logging behavior should be considered persistent and potentially sensitive.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install photo-spots - 安装完成后，直接呼叫该 Skill 的名称或使用
/photo-spots触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v3.2.0
photo-spots v3.2.0
- Updated SKILL.md with strict CLI-only execution rules: data MUST come from flyai CLI output.
- Added multi-language support and output requirements based on user's input language (Chinese or English).
- Enforced that each attraction result must include a `[Book]({detailUrl})` link to ensure all info is sourced from flyai.
- Expanded supported travel services (flights, hotels, tickets, insurance, car rental, etc.), all via Fliggy.
- Detailed scenario playbooks and output formatting rules for improved accuracy and consistency.
- Clarified activation/trigger conditions and restricted responses to matching travel photography queries only.
元数据
常见问题
Photo Spots 是什么？
Find the most photogenic and instagrammable spots — iconic viewpoints, colorful streets, architectural marvels, and hidden gems for your social media. Also s... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 73 次。
如何安装 Photo Spots？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install photo-spots」即可一键安装，无需额外配置。
Photo Spots 是免费的吗？
是的，Photo Spots 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
Photo Spots 支持哪些平台？
Photo Spots 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Photo Spots？
由 xiejinsong（@xiejinsong）开发并维护，当前版本 v3.2.0。
推荐 Skills