QG Car

Use when the user wants help with Qiguan campus bus tickets using the local qg CLI, including listing schedules, choosing Zhuhai/South/East campus routes, ge...

This package appears to do what it says: query schedules and build WeChat order-entry links. Before installing, prefer safer install paths: (1) install the npm package from the registry (npm install -g qg-skill) rather than piping a remote script into bash; (2) if you must run the install script, review install.sh locally first to confirm it does only the expected git/npm/copy operations; (3) note the CLI will write a cache file to ~/.qiguan-cli/last-list.json and will make network requests to the ticketing API (https://ebk.17u.cn) and build links to https://trans.17u.cn — that network activity is required for its purpose but be aware it contacts external services; (4) avoid storing passenger PII in the CLI as recommended by the README; and (5) if you need higher assurance, review the upstream GitHub repository and published npm package contents and signatures before installing. If you want me to, I can fetch and summarize the install.sh or point to lines in the code that perform network, filesystem, and clipboard operations.

Type: OpenClaw Skill Name: qgcar-skill Version: 0.1.0 The qgcar-skill bundle is a legitimate utility for querying Qiguan campus bus schedules and generating WeChat booking links. The code (dist/cli.js, dist/api.js) interacts with a known travel service API (17u.cn) and includes explicit safety boundaries in SKILL.md to prevent the AI agent from handling sensitive passenger information or automated payments. The installation script (install.sh) and clipboard operations are standard for this type of tool, and no evidence of data exfiltration, malicious execution, or prompt injection was found.