智能旅游记录

智能旅行游记生成器，支持多媒体素材记录、自动时间线整理、文学性叙事生成与多格式导出；当用户需要开始一段旅行记录、结束当前旅行、记录旅途点滴、补充旅行素材、预览游记内容、生成完整游记或导出游记文件时自动触发使用

This skill is internally consistent and appears benign, but before installing consider: 1) It saves uploads and metadata locally under ./travelogue_data/uploads — those files may include EXIF GPS and personal data, so choose storage location/permissions carefully. 2) You must install the declared Python packages (Pillow, markdown, jinja2, weasyprint); weasyprint can require extra system libraries (fonts, cairo). 3) The skill relies on platform multimodal/geolocation/speech services, which will send user content to those services — review your platform privacy settings. 4) Review the included scripts if you plan to run them on sensitive hosts (they perform file copy/delete operations on the travelogue_data directory). 5) Run the skill under a user account with limited permissions (not root) and consider backups/quotas for uploads. If you need higher assurance, ask the author for an install script or a vetted package and/or run the code in an isolated environment first.

Type: OpenClaw Skill Name: travelogue-weaver Version: 1.0.0 The skill bundle contains functional scripts for managing travel logs but exhibits high-risk file handling vulnerabilities. Specifically, `scripts/moment_manager.py` uses `shutil.copy2` on a user-provided `raw_path` without sanitization, potentially allowing an attacker to read arbitrary system files by copying them into the application's upload directory. Similarly, `scripts/export_generator.py` accepts an `output` path argument and performs `os.makedirs` and file writes without path validation, which could lead to arbitrary file write or overwrite attacks (Path Traversal). While these capabilities are linked to the stated purpose of managing and exporting travel media, the lack of security controls around file system operations poses a significant risk in an agentic environment.