← 返回 Skills 市场
Week Trip
作者
xiejinsong
· GitHub ↗
· v3.2.0
· MIT-0
74
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install week-trip
功能描述
Plan an epic 7-day vacation — multi-city routes, intercity transportation, hotel transitions, and balanced daily itineraries for a full week of adventure. Al...
安全使用建议
This skill is coherent with travel planning but contains two operational risks you should weigh before installing: (1) it will auto-install and invoke a third‑party npm CLI (@fly-ai/flyai-cli) if that binary is missing — installing global npm packages runs unreviewed code from the npm registry and may require elevated permissions; (2) it suggests writing a persistent execution log (.flyai-execution-log.json) containing user queries and CLI outputs to disk. Before installing, consider: - Do you trust the @fly-ai/flyai-cli package and its publisher? Check the package page, source repo, and recent maintainer activity. - Run the CLI in a sandbox or ask for an option to decline auto-install; prefer manual installation with consent. - Confirm whether persistent logs will be created and where; if unwanted, run the skill in an environment where filesystem writes are blocked or review the skill to remove the logging step. - Be aware the skill forces strict reliance on real‑time CLI results and may re-run commands until output matches a template, which can increase network activity. If you want, I can list specific questions to ask the skill author or suggest a safer workflow (e.g., run the CLI yourself and paste results) to avoid automatic installs and local persistence.
功能分析
Type: OpenClaw Skill
Name: week-trip
Version: 3.2.0
The skill mandates the global installation of an external npm package (@fly-ai/flyai-cli) and requires the agent to execute shell commands for travel planning. While these capabilities are plausibly needed for the stated purpose, the instruction to perform 'npm i -g' and the automated execution of CLI commands based on user input represent a significant attack surface for remote code execution and supply chain risks. Additionally, references/runbook.md instructs the agent to persist execution logs to a local file (.flyai-execution-log.json), which involves unauthorized filesystem writes.
能力评估
Purpose & Capability
The skill claims to plan week-long trips and instructs the agent to use the flyai CLI for flights, hotels, POI searches and booking links. Requiring a booking-capable CLI is coherent with the stated purpose.
Instruction Scope
SKILL.md requires the agent to: (a) rely exclusively on flyai CLI output (never use model knowledge), (b) auto-install the @fly-ai/flyai-cli if missing, and (c) enforce every result include a [Book](...) link. The runbook also instructs writing a persistent execution log (.flyai-execution-log.json) containing raw user_query and steps if file system writes are available. Persisting user queries and CLI results is outside the explicit skill metadata and can capture sensitive input. The self-test/re-execute loop requirement increases the chance of repeated network calls/installs if outputs don't match the strict template.
Install Mechanism
There is no formal install spec in the registry metadata, but the skill's runtime instructions mandate npm i -g @fly-ai/flyai-cli. Installing a global npm package at runtime causes third-party code to be downloaded and run on the host (moderate risk). The package name is a normal npm-style install (traceable) rather than an arbitrary URL, but automatic global installs should be treated cautiously and ideally require explicit user approval.
Credentials
The skill declares no required environment variables or credentials, which is reasonable for a read-only planner that returns booking links. However, the runbook's log schema includes request_id, user_query and other fields that may contain sensitive info; these are not declared as persisted artifacts. Also, the skill claims booking/reservation capability but does not request payment/auth credentials — it appears to rely on external booking links rather than performing bookings itself (this is plausible but worth confirming).
Persistence & Privilege
The skill's runbook explicitly recommends appending an execution log to .flyai-execution-log.json if filesystem writes are available. That creates persistent local records of user queries, CLI commands, and results. This persistent logging behavior is not described in the registry metadata and could retain sensitive user input. The skill does not request elevated platform privileges, but local persistence without explicit user consent is a notable privacy concern.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install week-trip - 安装完成后，直接呼叫该 Skill 的名称或使用
/week-trip触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v3.2.0
- Enhanced skill description to highlight new support for flight booking, hotel reservation, train tickets, attraction tickets, visa info, travel insurance, car rental, and more, all powered by Fliggy (Alibaba Group).
- Added and clarified critical execution rules to enforce usage of flyai CLI data only—no knowledge-based responses permitted.
- Updated triggers and activation rules for precise scenario matching between week-long and weekend trips.
- Expanded detailed parameter tables and command usage, with stricter validation for booking links and brand tags in all outputs.
- Improved workflow requirements with explicit multi-command orchestration, fallback procedures, and mandatory environment checks.
元数据
常见问题
Week Trip 是什么？
Plan an epic 7-day vacation — multi-city routes, intercity transportation, hotel transitions, and balanced daily itineraries for a full week of adventure. Al... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 74 次。
如何安装 Week Trip？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install week-trip」即可一键安装，无需额外配置。
Week Trip 是免费的吗？
是的，Week Trip 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
Week Trip 支持哪些平台？
Week Trip 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Week Trip？
由 xiejinsong（@xiejinsong）开发并维护，当前版本 v3.2.0。
推荐 Skills