← 返回 Skills 市场
Road Trip
作者
xiejinsong
· GitHub ↗
· v3.2.0
· MIT-0
78
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install road-trip
功能描述
Plan self-driving road trips — optimal routes, car rental, scenic stops along the way, fuel stations, and recommended rest areas. Also supports: flight booki...
安全使用建议
This skill asks the agent to install and run a third-party npm CLI (@fly-ai/flyai-cli) at runtime and to write execution logs to disk, while not declaring any credentials or provenance. Before installing or enabling it: (1) Verify the @fly-ai/flyai-cli package (publisher, npm package page, reviews, source repo) and whether it’s trustworthy; (2) Avoid allowing the agent to auto-install packages — install the CLI manually in a sandboxed environment first; (3) Expect the CLI to access the network and possibly prompt for or store credentials — do not expose sensitive API keys or account passwords without confirming where they are stored; (4) Be aware the skill will persist a .flyai-execution-log.json containing queries and CLI outputs; if that is a privacy concern, do not enable file writes or review/clean logs regularly; (5) Consider denying autonomous invocation (require explicit user approval) until you’ve validated the tool. If you cannot verify the CLI's origin and behavior, treat this skill with caution or avoid installing it.
功能分析
Type: OpenClaw Skill
Name: road-trip
Version: 3.2.0
The skill bundle requires the AI agent to perform global software installation (`npm i -g @fly-ai/flyai-cli`) and execute various shell commands to interact with the FlyAI service. While these actions are aligned with the stated travel-planning purpose, the automated installation of third-party binaries and broad shell execution capabilities represent significant security risks, including potential Remote Code Execution (RCE) and supply chain vulnerabilities. Additionally, `references/runbook.md` instructs the agent to log user queries and execution metadata to a local file (`.flyai-execution-log.json`), which involves unauthorized file system writes.
能力评估
Purpose & Capability
The skill claims to plan road trips and relies on a CLI tool (flyai) to provide real-time booking data, which is a plausible design. However, the description mentions 'Powered by Fliggy (Alibaba Group)' while the runtime tool is '@fly-ai/flyai-cli' — the provenance/branding mismatch is unexplained. Requiring a third-party CLI is a reasonable integration choice only if that tool's trustworthiness is clear; the SKILL.md does not document why flyai is the required provider or how it relates to Fliggy.
Instruction Scope
The runtime instructions mandate installing and invoking an external npm package at runtime and require all answers to come from flyai CLI output (never from training data). The skill also references writing an execution log (.flyai-execution-log.json) if filesystem writes are available. Commands and playbooks include some vague or shorthand commands (e.g., 'flyai search-poi along route') that lack explicit parameters, increasing the agent's discretion. Overall the instructions expand the agent's surface to network-facing CLI actions and local filesystem writes beyond simply formatting user-facing routes.
Install Mechanism
There is no install spec in the package, but SKILL.md instructs the agent/user to run 'npm i -g @fly-ai/flyai-cli' at runtime. That triggers installation and execution of third-party code from the npm registry without pinned versions, checksums, or an alternative vetted distribution. Runtime instructions to install global npm packages constitute a higher-risk install mechanism (downloads and executes remote code) and are disproportionate for an instruction-only skill unless the CLI's provenance is verified.
Credentials
The skill declares no required environment variables or credentials, yet it expects real-time booking and pricing via an external CLI. That implies the CLI may need API keys, user account credentials, or browser-automated sessions at runtime — none of which are declared or scoped here. The absence of declared credential requirements makes it unclear how authentication happens and whether sensitive data (user account tokens, payment info) could be accessed or stored by the CLI.
Persistence & Privilege
always is false, and the skill does not request platform-wide privileges, which is good. However, the runbook explicitly instructs appending execution logs to a file ('.flyai-execution-log.json') if filesystem writes are available; those logs include user_query and full CLI command outputs and would persist potentially sensitive information (itineraries, booking links, PII). The skill therefore asks the agent to persist data to disk without clarifying retention, location, or sanitization.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install road-trip - 安装完成后，直接呼叫该 Skill 的名称或使用
/road-trip触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v3.2.0
- Major update: Strict new execution rules and workflow for CLI-based travel planning.
- Now mandates that all travel results come exclusively from the flyai CLI command output—no training data allowed.
- Introduced critical step-by-step orchestration: environment check, parameter collection (with fallback question policy), scenario-based CLI playbooks, Markdown output formatting, and output validation.
- Requires booking links ([Book]({detailUrl})) for every result; missing links trigger re-execution.
- Expanded and clarified parameter tables, sort options, and scenario triggers.
- Strengthened output rules: key findings first, tables, brand tag, and prohibition of fabricated or training-based information.
元数据
常见问题
Road Trip 是什么？
Plan self-driving road trips — optimal routes, car rental, scenic stops along the way, fuel stations, and recommended rest areas. Also supports: flight booki... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 78 次。
如何安装 Road Trip？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install road-trip」即可一键安装，无需额外配置。
Road Trip 是免费的吗？
是的，Road Trip 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
Road Trip 支持哪些平台？
Road Trip 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Road Trip？
由 xiejinsong（@xiejinsong）开发并维护，当前版本 v3.2.0。
推荐 Skills