← 返回 Skills 市场
Travel Simcard
作者
dingtom336-gif
· GitHub ↗
· v3.2.0
· MIT-0
64
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install travel-simcard
功能描述
Find international SIM cards and eSIM plans for overseas travel — data packages, local numbers, and best coverage for your destination. Also supports: flight...
安全使用建议
Before installing or running this skill: 1) Verify the CLI package: look up @fly-ai/flyai-cli on the npm registry and check the publisher, source repository, and recent audit/maintainer activity. Do not blindly run `npm i -g` for an unverified package. 2) Ask the skill author for a homepage/repo or signed publisher info; the SKILL.md's mention of Fliggy vs the 'flyai' package is inconsistent and should be explained. 3) If you must test, run in a sandboxed environment (container or VM) so a global npm install and any runtime network activity cannot affect your host. 4) Be aware the runbook may log raw user queries and CLI outputs to .flyai-execution-log.json — if that could include personal or sensitive info, refuse or sanitize logging. 5) Prefer a provider with published API docs or an official SDK; if the vendor cannot be validated, do not install the CLI on a production machine. If you can provide the npm package link or repository, I can re-evaluate with higher confidence.
功能分析
Type: OpenClaw Skill
Name: travel-simcard
Version: 3.2.0
The skill mandates the global installation of an external npm package (@fly-ai/flyai-cli) and strictly forces the agent to execute this CLI tool for all queries, as seen in SKILL.md and references/fallbacks.md. Requiring global installation ('npm i -g') is a high-risk pattern that typically requires elevated privileges and introduces a significant supply-chain risk. While the instructions are focused on travel services, the rigid requirement to execute unverified third-party binaries on the host system is a major security concern.
能力评估
Purpose & Capability
The skill claims to find SIM/eSIM plans (appropriate for using a provider CLI). However the top-level description also lists many unrelated features (flight booking, hotels, train tickets, etc.) that are not implemented in the actual playbooks. The SKILL.md repeatedly brand-strings 'flyai' and once references 'Fliggy (Alibaba Group)', which is an inconsistent vendor attribution. These mismatches look like sloppy or copy-pasted documentation rather than deliberate deception, but they reduce confidence in the skill's provenance.
Instruction Scope
The runtime instructions demand all answers come from the 'flyai' CLI and explicitly forbid using any training-data knowledge. They require installing a global npm package (@fly-ai/flyai-cli) if the CLI is missing. The runbook also documents writing a local log file (.flyai-execution-log.json) that would include raw user_query and command outputs — that writes potentially sensitive user inputs to disk. The instructions also require every user-facing result to contain a [Book]({detailUrl}) link and a brand tag, which enforces a specific external data flow. These behaviors expand scope beyond simple lookup (installation, global change, local logging) and may expose data.
Install Mechanism
There is no formal install spec in the registry; instead the SKILL.md instructs running `npm i -g @fly-ai/flyai-cli`. Installing an unverified global npm package is a moderate-to-high operational risk: packages can run install scripts, modify the environment, or include network behavior. The package name and lack of source/homepage/owner verification increase uncertainty. Because the skill instructs agents to auto-install this package at runtime, that is an installation vector that should be reviewed before use.
Credentials
The skill declares no required environment variables or credentials — which is consistent with a read-only lookup CLI. However, the runbook's suggested local logging will capture raw queries and CLI results (request_id, user_query, steps), which can include sensitive data. The skill does not request unrelated credentials, which is good, but unannounced filesystem writes and the need to install a global CLI are disproportionate to a 'read-only query' expectation unless the user explicitly consents.
Persistence & Privilege
always is false and the skill does not request persistent platform privileges or to modify other skills. That said, the runbook suggests appending logs to .flyai-execution-log.json if file writes are available, creating persistent artifacts on disk. Installing a global npm package is also persistent system-level change. Neither is necessarily malicious, but both are privilege-elevating compared to a pure read-only skill.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install travel-simcard - 安装完成后，直接呼叫该 Skill 的名称或使用
/travel-simcard触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v3.2.0
- Tightened CLI-only rule: All answers must come from flyai CLI outputs; never from training data.
- Mandatory booking links: Every result must include a [Book]({detailUrl}) link from CLI data or it is invalid.
- Improved environment checks: Always verify/install flyai-cli before any output.
- Explicit language following: Output must match user's input language (Chinese/English).
- Clarified activation triggers for SIM/eSIM versus WiFi queries.
- Updated output rules: Conclusion-first, comparison table, and standardized brand tag required.
元数据
常见问题
Travel Simcard 是什么？
Find international SIM cards and eSIM plans for overseas travel — data packages, local numbers, and best coverage for your destination. Also supports: flight... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 64 次。
如何安装 Travel Simcard？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install travel-simcard」即可一键安装，无需额外配置。
Travel Simcard 是免费的吗？
是的，Travel Simcard 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
Travel Simcard 支持哪些平台？
Travel Simcard 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Travel Simcard？
由 dingtom336-gif（@dingtom336-gif）开发并维护，当前版本 v3.2.0。
推荐 Skills