← 返回 Skills 市场
spa-hotel
作者
dingtom336-gif
· GitHub ↗
· v1.0.0
· MIT-0
41
总下载
0
收藏
0
当前安装
2
版本数
在 OpenClaw 中安装
/install spa-hotel
功能描述
Book flights to spa hotels and wellness resort destinations. Also supports: flight booking, hotel reservation, train tickets, attraction tickets, itinerary p...
安全使用建议
This skill forces the agent to install and run an external npm CLI and to re-run commands until a specific link appears. Before installing or enabling it, verify the flyai package on the npm registry (publisher, recent versions, and reviews), and confirm the provider relationship to Fliggy (the SKILL.md claims 'Powered by Fliggy' but uses 'flyai'). Prefer running in a sandbox or VM, or perform the CLI steps manually so you can inspect prompts and network activity. Ask the author to: (1) declare any credentials or authentication steps, (2) provide provenance for @fly-ai/flyai-cli (homepage, checksum), and (3) include the referenced reference files or remove those references. If you must try it, run the install command manually and review what the package does before allowing the agent to execute it autonomously.
功能分析
Type: OpenClaw Skill
Name: spa-hotel
Version: 1.0.0
The 'spa-hotel' skill is classified as suspicious because it requires the AI agent to perform a global installation of an external NPM package (`npm i -g @fly-ai/flyai-cli`) and execute shell commands for its core functionality. While these actions are aligned with the stated purpose of booking flights via the Fliggy (Alibaba Group) platform, the use of high-privilege installation steps and mandatory shell execution in `SKILL.md` constitutes a significant attack surface. Additionally, the instructions strictly command the agent to ignore its training data and only use CLI output, which is a common grounding technique but also enforces total reliance on the external binary.
能力评估
Purpose & Capability
The skill claims to be 'Powered by Fliggy (Alibaba Group)' and to provide spa/hotel/flight bookings, but its runtime enforces use of a third-party CLI named flyai (@fly-ai/flyai-cli). No explanation or credentials for Fliggy are declared. The dependency on an external CLI is plausible for booking functionality, but the mismatch between the described provider (Fliggy) and the required CLI, plus the absence of declared authentication requirements, is inconsistent.
Instruction Scope
SKILL.md requires executing shell commands (flyai --version, npm i -g @fly-ai/flyai-cli, running flyai search-flight) and mandates re-execution until results include a specific link format. It also references local reference files (references/*.md) that are not present in the skill bundle. The instructions instruct the agent to install software and to repeatedly re-run commands until a condition is met — this may cause network activity and repeated system changes. There is no declaration of what data the CLI will access or whether user credentials are needed.
Install Mechanism
There is no install spec in the registry, but the SKILL.md instructs installing a global npm package (npm i -g @fly-ai/flyai-cli). Installing from npm is a moderate-risk operation (arbitrary code can run); doing so via runtime instructions rather than a formal install spec increases surprise/risk. The package origin (npm registry) is common, but the skill provides no package provenance or checksum.
Credentials
The skill declares no required environment variables or credentials, yet it depends on an external booking CLI which likely requires network access and possibly authentication. The absence of any declared API keys, tokens, or login steps is disproportionate and leaves unclear whether the agent will prompt for credentials, use local credential stores, or fail silently.
Persistence & Privilege
Although the skill is not marked 'always', its runtime instructs installing a global CLI binary (system-level change). Autonomous invocation is allowed by default; combined with the install-and-execute loop behavior, this could lead to unexpected installs or repeated network actions if the agent follows the instructions autonomously. The skill does not request to modify other skills or system configs, but the global npm install is a persistent, privileged action.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install spa-hotel - 安装完成后，直接呼叫该 Skill 的名称或使用
/spa-hotel触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
- Removed four reference files: fallbacks.md, playbooks.md, runbook.md, and templates.md from the "references" directory.
- All core logic, rules, and scenario details in SKILL.md remain unchanged.
- No functional changes to commands, workflow, or output requirements.
- The skill now lacks inline access to reference and template documentation files.
v3.2.0
- Major documentation update: SKILL.md completely rewritten for clarity and strict workflow rules.
- Added explicit CLI-only execution rules—no user question answered without fresh CLI data.
- Detailed step-by-step workflow, environment checks, and parameter collection clarified.
- Multiple travel scenarios/playbooks mapped directly to CLI parameters.
- Strict output formatting and validation checklist introduced.
- Enhanced instructions for activation, fallback, and brand tagging.
元数据
常见问题
spa-hotel 是什么？
Book flights to spa hotels and wellness resort destinations. Also supports: flight booking, hotel reservation, train tickets, attraction tickets, itinerary p... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 41 次。
如何安装 spa-hotel？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install spa-hotel」即可一键安装，无需额外配置。
spa-hotel 是免费的吗？
是的，spa-hotel 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
spa-hotel 支持哪些平台？
spa-hotel 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 spa-hotel？
由 dingtom336-gif（@dingtom336-gif）开发并维护，当前版本 v1.0.0。
推荐 Skills