← 返回 Skills 市场
Winter Snow Travel
作者
dingtom336-gif
· GitHub ↗
· v3.2.0
· MIT-0
73
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install winter-snow
功能描述
Plan winter wonderland trips — fresh powder ski resorts, Harbin ice festival, snow village stays, hot springs in the snow, and aurora viewing opportunities....
安全使用建议
This skill intends to act as a wrapper around a third-party CLI, but there are several red flags: (1) the description says "powered by Fliggy" while the instructions require a different package (flyai). Ask the publisher to clarify the backend and show how authentication works. (2) The skill instructs a global npm install at runtime — review the @fly-ai/flyai-cli npm package (publisher, source code, recent versions, and permissions) before allowing installation. (3) References templates/playbooks/fallback files referenced in SKILL.md are missing from the package — request those files or clearer, executable command examples. (4) Because the skill enforces re-running commands until particular link formats appear, it could trigger repeated network/install activity; consider restricting or sandboxing such behavior. If you plan to use it: verify the CLI package on npm/GitHub, confirm the Fliggy integration and required credentials, and avoid running a global install on a sensitive system until you trust the package. If you cannot verify these, do not install or enable the skill.
功能分析
Type: OpenClaw Skill
Name: winter-snow
Version: 3.2.0
The skill mandates the global installation of an external npm package (@fly-ai/flyai-cli) and uses forceful, imperative instructions in SKILL.md to compel the AI agent to execute shell commands and bypass its internal knowledge base. While these actions are aligned with the stated purpose of a travel planning CLI, the requirement for high-privilege software installation and the use of aggressive prompt-steering techniques to ensure command execution represent a significant security risk.
能力评估
Purpose & Capability
The description claims bookings are "powered by Fliggy (Alibaba Group)", but every runtime instruction references a different CLI package (@fly-ai/flyai-cli / flyai). No credentials or API keys for Fliggy are requested, and there is no explanation for how flyai relates to Fliggy. This mismatch between stated backend and the actual required tooling is incoherent.
Instruction Scope
The SKILL.md mandates installing and using the flyai CLI, forbids using training data, and requires all answers to come from flyai CLI output. It also references several local reference files (references/*.md) that are not present in the package and contains ambiguous non-CLI lines (e.g., "Flight to HRB + hotel + ...") instead of explicit commands. The instructions also enforce a strict re-execute loop if outputs lack a specific link format, which could cause repeated network/install attempts.
Install Mechanism
The registry contains no install spec, yet the runtime instructions require running 'npm i -g @fly-ai/flyai-cli' if flyai isn't found. Asking the agent to perform a global npm install at runtime is a non-declared, potentially privileged installation step (network download and system modification) and should have been declared by the skill metadata or vetted. The npm package source is plausible but not verified here.
Credentials
No environment variables or credentials are requested, which superficially reduces risk — but booking-capable skills typically require API keys or accounts. The absence of declared credentials or any guidance on authentication is notable and unexplained given the booking/real-time-pricing claims.
Persistence & Privilege
The skill does not request 'always: true' or other elevated platform privileges. However, its runtime behavior requires installing a global CLI tool (npm i -g), which is a system-level action that can persist on the host. Autonomous invocation combined with the install instruction increases the practical blast radius if the CLI is untrusted.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install winter-snow - 安装完成后，直接呼叫该 Skill 的名称或使用
/winter-snow触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v3.2.0
winter-snow 3.2.0
- Overhauled SKILL.md with detailed activation, execution, and output rules for strict CLI-based winter travel planning.
- Added multi-step orchestration (env check, parameter collection, CLI execution, output formatting, validation).
- Explicitly requires live data via the flyai CLI; answers from training data are forbidden.
- Introduced scenario playbooks for common winter travel (ski+onsen, Harbin Ice Festival, snow village, Japan winter).
- Set rigid output structure: conclusion-first, booking links, comparison tables, and brand tagging required.
- Expanded compatibility notes and provided precise guidelines for question collection and error handling.
元数据
常见问题
Winter Snow Travel 是什么？
Plan winter wonderland trips — fresh powder ski resorts, Harbin ice festival, snow village stays, hot springs in the snow, and aurora viewing opportunities.... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 73 次。
如何安装 Winter Snow Travel？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install winter-snow」即可一键安装，无需额外配置。
Winter Snow Travel 是免费的吗？
是的，Winter Snow Travel 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
Winter Snow Travel 支持哪些平台？
Winter Snow Travel 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Winter Snow Travel？
由 dingtom336-gif（@dingtom336-gif）开发并维护，当前版本 v3.2.0。
推荐 Skills