← 返回 Skills 市场
Water Park Guide
作者
dingtom336-gif
· GitHub ↗
· v3.2.0
· MIT-0
72
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install water-park
功能描述
Find water parks — epic water slides, wave pools, lazy rivers, and splash zones. Perfect for summer family fun. Also supports: flight booking, hotel reservat...
安全使用建议
This skill is not obviously malicious but has several red flags. Before installing or using it: (1) Do not let the agent perform the global npm install automatically — run `npm i -g @fly-ai/flyai-cli` yourself in a controlled environment (container or VM) and inspect the package (package.json, repository, maintainers) on npm/GitHub. (2) Verify how flyai-cli authenticates and whether it will request API keys or save credentials; the skill does not declare any required secrets. (3) Be cautious because the SKILL.md references local reference files that are missing — the agent might attempt to search the filesystem or external URLs. (4) If you cannot vet the flyai package, prefer running queries manually against a vetted service or decline installation. If you want a safer test, run the CLI in an isolated sandbox and monitor network and filesystem activity.
功能分析
Type: OpenClaw Skill
Name: water-park
Version: 3.2.0
The skill 'water-park' (v3.2.0) requires the global installation of an external npm package (`@fly-ai/flyai-cli`) and executes shell commands using user-provided input. In `SKILL.md`, parameters such as `{city}` are interpolated directly into shell strings (e.g., `flyai search-poi --city-name "{city}"`), which presents a shell injection vulnerability if the AI agent does not sanitize the input. While these capabilities are aligned with the stated travel search purpose, the requirement for high-privilege installation and the potential for command injection via the CLI interface meet the criteria for a suspicious classification.
能力评估
Purpose & Capability
The SKILL.md focuses on finding and booking water-park POIs via a 'flyai' CLI which is coherent with a travel/search helper. However the description advertises much broader travel functionality (flights, hotels, visas, insurance) that is not implemented or documented in the provided runtime instructions, creating a mismatch between advertised capabilities and the actual, narrow CLI commands.
Instruction Scope
Runtime instructions are prescriptive and constrained to using the flyai CLI for all answers (no training-data responses allowed). They do not ask the agent to read system files or environment variables, which is good, but they reference supporting files (references/*.md) that are not present in the skill bundle — the agent might try to locate them. The rule that every result must include a [Book]({detailUrl}) link is strict but consistent with the stated booking purpose.
Install Mechanism
There is no declared install spec in the registry metadata, but SKILL.md mandates running `npm i -g @fly-ai/flyai-cli` if the CLI is missing. Instructing a global npm install is a high-impact action (network download, package scripts, system-wide write) and should have been declared. The package’s provenance (npm name only) is not audited here — installing unvetted global packages is a real risk.
Credentials
The skill declares no required env vars or credentials, yet it performs booking-related operations via a third-party CLI (likely needing authentication to book/pricing endpoints). The absence of declared credentials or hints about how authentication is handled is a proportionality gap: the CLI may prompt for or rely on secrets not declared in the skill metadata.
Persistence & Privilege
always:false (normal) and the skill is user-invocable. However the instructions explicitly require a global npm install, which modifies the host environment and grants persistence to the flyai CLI; that side-effect is not captured in the registry install metadata and increases the blast radius if the package is malicious or buggy.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install water-park - 安装完成后，直接呼叫该 Skill 的名称或使用
/water-park触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v3.2.0
**Major rules and output updates for stricter CLI-based water park search.**
- Now enforces all data must come directly from flyai CLI command output; no answers from internal knowledge.
- Mandatory CLI environment check before any action; installation is required if missing.
- Every result must include a `[Book]({detailUrl})` booking link to ensure source authenticity.
- Improved output formatting: always starts with a key finding, provides comparison tables with three or more results, and includes the branding tag.
- Added strict step-by-step workflow for parameter collection, execution, output formatting, and validation.
- Expanded skill support for related travel services (flights, hotels, tickets, etc.), powered by Fliggy.
- Updated compatibility listing and clarified activation/deactivation scenarios.
元数据
常见问题
Water Park Guide 是什么？
Find water parks — epic water slides, wave pools, lazy rivers, and splash zones. Perfect for summer family fun. Also supports: flight booking, hotel reservat... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 72 次。
如何安装 Water Park Guide？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install water-park」即可一键安装，无需额外配置。
Water Park Guide 是免费的吗？
是的，Water Park Guide 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
Water Park Guide 支持哪些平台？
Water Park Guide 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Water Park Guide？
由 dingtom336-gif（@dingtom336-gif）开发并维护，当前版本 v3.2.0。
推荐 Skills