← 返回 Skills 市场
100
总下载
0
收藏
0
当前安装
3
版本数
在 OpenClaw 中安装
/install travel-risk-checker
功能描述
旅行交通风险检查助手，提供转机风险评估、延误酒店推荐、最后一公里交通检查三大核心功能
安全使用建议
This skill's functionality (transfer risk, hotel recommendations, last-mile checks) is coherent, but there are important mismatches and runtime risks you should resolve before installing: 1) Confirm exactly which environment variables and API keys are required (SKILL.md references TRAVEL_API_KEY, HOTEL_API_KEY, TRANSPORT_API_KEY) and ensure they are declared and limited in scope. 2) Ask the publisher for the source, checksum, and trust model for the MCP packages (@travel/mcp-server, @hotel/mcp-server, @city-transport/mcp-server). Running npx at runtime will fetch and execute remote code—only allow this if the packages are audited/trusted. 3) Verify where push notifications, SMS/email, and order data access will be sent/received and what credentials those integrations require; avoid providing high-privilege keys (e.g., broad cloud admin keys). 4) If you must test, run the skill in a restricted sandbox with network and secret access limited, monitor outbound network calls, and avoid reusing production credentials. 5) Prefer a version-pinned, audited install artifact or a manifest that explicitly lists required env vars/permissions; if the publisher cannot provide that, treat the skill as higher-risk and consider not installing.
功能分析
Type: OpenClaw Skill
Name: travel-risk-checker
Version: 1.0.2
The travel-risk-checker skill is designed to assist users with flight transit risks, hotel recommendations during delays, and last-mile transportation availability. It utilizes the Model Context Protocol (MCP) to interface with external travel, hotel, and transport data services via npx-delivered packages (e.g., @travel/mcp-server). The instructions in SKILL.md are well-structured, providing clear logic for risk assessment and error handling without any indicators of malicious intent, data exfiltration, or unauthorized execution.
能力评估
Purpose & Capability
The skill's name, description, and SKILL.md all align on transit risk, delay-hotel recommendations, and last-mile checks. However, the SKILL.md requires integration with three MCP servers (travel-data, hotel-booking, city-transport) and their API keys (TRAVEL_API_KEY, HOTEL_API_KEY, TRANSPORT_API_KEY) even though the registry metadata lists no required environment variables or primary credential. That undeclared credential requirement is inconsistent with the published skill metadata.
Instruction Scope
Runtime instructions reference $ARGUMENTS, $ORDER_DATA, $USER_LOCATION and call specific MCP methods (e.g., travel-data.get_order, hotel-booking.search_hotels). They also describe push notifications, SMS/email delivery, and automatic triggers. Those output channels and the data access (order data, flight status, user location) imply access to sensitive user data and communication channels, but the skill does not declare the credentials or permissions needed for those actions. The instructions also tell the agent to run npx commands to launch MCP servers at runtime, which will download and execute remote packages.
Install Mechanism
There is no formal install spec, but the SKILL.md requires launching MCP servers via npx (npx -y @travel/mcp-server, etc.). That means code will be pulled from npm (or the package's configured registry) at runtime and executed. Runtime npx installs are a moderate-to-high risk because arbitrary code is fetched and executed without an explicit install policy or pinned, audited artifact. package.json includes publishConfig that points to an internal registry (https://contextlab.alibaba-inc.com/skill), which raises additional questions about package provenance.
Credentials
The SKILL.md references TRAVEL_API_KEY, HOTEL_API_KEY, and TRANSPORT_API_KEY as environment variables for MCP servers, but the skill metadata declares no required env vars. Other necessary credentials for push notifications, SMS/email gateways, or accessing user orders are not declared either. Requesting multiple external API keys is reasonable for this functionality, but the absence of declared env vars and no explanation of required key scopes or minimal privileges is a mismatch and a potential risk for accidental over-permissioning or secret leakage.
Persistence & Privilege
always:false and disable-model-invocation:false (default) — the skill is not force-included and can be invoked autonomously like normal skills. The skill does not declare actions that modify other skills or global agent configuration. No install-time persistence is declared. Still, runtime npx execution could introduce code that persists or exfiltrates data if the fetched packages are malicious; that risk ties back to the install_mechanism concern above.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install travel-risk-checker - 安装完成后，直接呼叫该 Skill 的名称或使用
/travel-risk-checker触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.2
No code or documentation changes detected in this version.
- Version number bumped to 1.0.2 with no functional updates.
- No new features, bug fixes, or documentation edits in this release.
v1.0.1
No file changes detected.
No updates in this version.
v1.0.0
travel-risk-checker 1.0.0 - Initial release
- Introduces three core travel risk services: transit risk assessment, delay hotel recommendations, and last-mile transport disruption alerts.
- Automates risk checks and suggestions based on travel orders, flight delays, and late-night arrivals.
- Integrates with MCP servers for real-time flight, hotel, and city transport data.
- Provides actionable output templates and risk levels for transparency and ease of use.
- Includes user-friendly alerts on multiple channels: order detail, push notifications, SMS/email, and app homepage.
元数据
常见问题
Transit Risk Assessment & Delay Hotel Recommendations & Last-Mile Transport Check 是什么？
旅行交通风险检查助手，提供转机风险评估、延误酒店推荐、最后一公里交通检查三大核心功能. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 100 次。
如何安装 Transit Risk Assessment & Delay Hotel Recommendations & Last-Mile Transport Check？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install travel-risk-checker」即可一键安装，无需额外配置。
Transit Risk Assessment & Delay Hotel Recommendations & Last-Mile Transport Check 是免费的吗？
是的，Transit Risk Assessment & Delay Hotel Recommendations & Last-Mile Transport Check 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
Transit Risk Assessment & Delay Hotel Recommendations & Last-Mile Transport Check 支持哪些平台？
Transit Risk Assessment & Delay Hotel Recommendations & Last-Mile Transport Check 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Transit Risk Assessment & Delay Hotel Recommendations & Last-Mile Transport Check？
由 mlyjqx（@mlyjqx）开发并维护，当前版本 v1.0.2。
推荐 Skills