Trip Planner 0→1

从 0 到 1 制作一份完整的自由行出行攻略，覆盖需求采集、多源资源调研（小红书 MCP + 地图 + Web 搜索）、方案决策、Markdown 行程书产出、交互式 Todo 网页（本地存储 + 可选云端同步）、一键部署到静态托管的端到端工作流。适用于东南亚海岛、日本、欧洲自驾、美洲公路旅行等任何自由行场景。触...

This skill appears to do what it says: generate itineraries, run multi-source research, and provide an interactive, optionally-synced todo page. Things to consider before you install/use it: - Sync backends are optional. The default (localStorage) keeps everything on your device only. Do not paste production tokens into the example JS unless you understand the backend you chose. - If you enable Gist/JSONBin, those require a GitHub PAT or JSONBin Master Key. Keep these secrets private and prefer creating a dedicated token with minimal scopes (e.g., gist scope only). Be careful: creating a public gist by mistake can leak data. - Self-host and Cloudflare Worker options are provided as templates. If you deploy the Node self-host, secure your server (HTTPS via reverse proxy, optional X-Auth-Token) and do not expose the raw service without auth. The provided self-host sample listens on 127.0.0.1 by default — follow the instructions to reverse-proxy and secure it. - The SKILL suggests running third-party components (xiaohongshu-mcp Docker image, unpkg-hosted Leaflet). Verify those upstream projects yourself and only pull images/releases you trust. - The browser-side JS (todo-sync.js) stores state in localStorage and optionally posts to your configured backend. Review the code before using it and avoid embedding sensitive data (PNRs, partial credit card info) into sharable rooms. If you want extra assurance, request: (1) confirmation of the exact Docker image/tag for MCP, (2) a short walkthrough of how the skill's agent would use any credentials you provide, or (3) a security checklist for deploying the self-hosted Node/Cloudflare Worker (suggested auth options and recommended token scopes).

Type: OpenClaw Skill Name: trip-planner-0to1 Version: 1.0.0 The skill bundle is classified as suspicious due to insecure credential handling and supply chain risks. The 'todo-sync.js' file provides a template that encourages users to hardcode sensitive secrets, such as GitHub Personal Access Tokens (PATs) and JSONBin Master Keys, directly into client-side JavaScript for data synchronization. Additionally, the 'SKILL.md' instructions direct the agent to facilitate the download and execution of third-party binaries and Docker images from an external GitHub repository (xpzouying/xiaohongshu-mcp). While these features support the stated goal of trip planning and synchronization, the implementation patterns create a high risk of credential exposure and supply chain compromise.