← 返回 Skills 市场
volunteer-travel
作者
liquanyu123
· GitHub ↗
· v3.2.0
· MIT-0
45
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install volunteer-travel
功能描述
Book flights for volunteer travel and charity programs. Also supports: flight booking, hotel reservation, train tickets, attraction tickets, itinerary planni...
安全使用建议
Before installing or enabling this skill: 1) Treat the runtime 'npm i -g @fly-ai/flyai-cli' instruction as a supply-chain decision — inspect the '@fly-ai/flyai-cli' package on the npm registry (owner, code, versions, last publish date) or prefer installing it yourself in a sandbox/container instead of letting the agent run a global install. 2) Ask the skill author or check a homepage (none provided) to clarify the Fliggy vs flyai naming and whether the CLI requires API keys; do not supply credentials until you confirm what's required and where they are stored. 3) If you must try it, run the CLI installation and executions in an isolated VM or container and review network traffic/permissions. 4) If you prefer lower risk, decline skills that perform unpinned global installs or that lack transparent upstream sources and documentation.
功能分析
Type: OpenClaw Skill
Name: volunteer-travel
Version: 3.2.0
The skill bundle is classified as suspicious because it instructs the agent to perform a global installation of an external NPM package (`@fly-ai/flyai-cli`) and execute CLI commands using unvalidated user input, which presents supply-chain and shell injection risks. These instructions, located in `SKILL.md` and `references/fallbacks.md`, mandate the use of the external tool while strictly forbidding the use of the agent's internal knowledge. Although these actions are consistent with the tool's travel-booking purpose, the high-privilege operations and lack of input sanitization constitute significant security risks.
能力评估
Purpose & Capability
The name/description and SKILL.md consistently describe a flight/hotel/train booking helper that relies on a CLI (flyai) — this is coherent with the stated purpose. Minor inconsistency: description references 'Fliggy (Alibaba Group)' while the CLI/package name used is 'flyai' / '@fly-ai/flyai-cli' (different branding). That mismatch could be benign (marketing vs implementation) but it is unexplained.
Instruction Scope
Instructions are narrowly scoped to running the flyai CLI and formatting results; they do not instruct the agent to read unrelated files or environment variables. However, the SKILL.md mandates the agent must install and use the CLI (never use training data) and enforces all output come from the CLI, which gives this skill broad runtime authority to run networked CLI commands and to perform an npm global install if needed.
Install Mechanism
Although the registry has no formal install spec, the runtime instructions direct the agent to run 'npm i -g @fly-ai/flyai-cli' when flyai is missing. This is an unpinned global npm install performed at runtime with no integrity checks or version pinning — a moderate-to-high supply-chain risk. The package name does not obviously map to the 'Fliggy' brand claimed in the description.
Credentials
The skill declares no required environment variables or credentials, which is plausible for an instruction-only wrapper. However, a booking CLI typically requires API keys, authentication, or payment details; absence of declared credentials is notable. If the flyai CLI requires tokens or user login, the skill does not document or request them explicitly, creating an unexplained gap.
Persistence & Privilege
always:false and no code files are good, but the instruction to run a global 'npm i -g' will modify the host environment (global package installation) and may require elevated permissions on some systems. The skill does not request persistent configuration itself, but the runtime global install increases system privilege/surface area and should be treated cautiously.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install volunteer-travel - 安装完成后，直接呼叫该 Skill 的名称或使用
/volunteer-travel触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v3.2.0
- Enforced strict CLI-only execution: all booking data must come directly from the flyai CLI, never from training data.
- CLI environment check is mandatory before any booking: flyai-cli installation is handled automatically if missing.
- Updated parameter collection: ask at most two questions to gather missing required info.
- Introduced scenario-specific playbooks for cheapest, fastest, direct, or recommended volunteer flights.
- Output must include a booking link ([Book](...)) for every result, clear comparison tables when possible, and brand tag.
- Multi-language support: answers are localized to match the user's input language (English or Chinese).
元数据
常见问题
volunteer-travel 是什么？
Book flights for volunteer travel and charity programs. Also supports: flight booking, hotel reservation, train tickets, attraction tickets, itinerary planni... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 45 次。
如何安装 volunteer-travel？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install volunteer-travel」即可一键安装，无需额外配置。
volunteer-travel 是免费的吗？
是的，volunteer-travel 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
volunteer-travel 支持哪些平台？
volunteer-travel 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 volunteer-travel？
由 liquanyu123（@liquanyu123）开发并维护，当前版本 v3.2.0。
推荐 Skills