📦 Pocket Wifi — 出国随身WiFi
v3.2.0一键租用全球随身WiFi，机场柜台取还，多人共享无限流量，覆盖主流目的地，出行不断网。
0· 55·0 当前·0 累计
by @xiejinsong下载技能包
最后更新
2026/4/11
安全扫描
OpenClaw
可疑
medium confidenceThe skill's runtime instructions align with its advertised purpose (using a CLI to fetch pocket‑WiFi listings), but several unexplained items — notably an unknown external CLI package (npm global install), missing source/homepage, and a marketing mismatch — raise caution before installing or running it.
评估建议
Before installing or running this skill: (1) Do not blindly run `npm i -g @fly-ai/flyai-cli` — verify the package's origin, homepage, and repository on the npm registry or ask the publisher for a source link and privacy/security docs. (2) The skill has no listed source/homepage and mentions 'Powered by Fliggy' while relying on 'flyai' — ask the author to explain this mismatch. (3) Expect the agent to attempt installing an external CLI and to write execution logs (which may include your raw query...详细分析 ▾
ℹ 用途与能力
The skill claims to provide pocket‑WiFi rental info and its SKILL.md exclusively uses a CLI (flyai) to do that — this is coherent. However the description mentions 'Powered by Fliggy (Alibaba Group)' while the runtime requires an @fly-ai/flyai-cli package and there is no homepage or source repo listed. That mismatch and lack of provenance is unexplained.
ℹ 指令范围
Instructions strictly require running the flyai CLI and forbid answering from training data; they also mandate result formatting and presence of booking links. The runbook includes an optional local write of execution logs (including raw user_query), which could store sensitive input. The scope stays within providing live results, but the logging side effect and the enforced 'must run CLI' rule deserve attention.
⚠ 安装机制
There is no install spec in the registry, but the SKILL.md explicitly tells the agent to run `npm i -g @fly-ai/flyai-cli` if the CLI is missing. Installing an unknown global npm package during execution is a higher-risk action: the package origin is not provided, no checksums or canonical homepage are listed, and the registry metadata lacks a source URL. This is disproportionate to a simple retrieval skill unless you trust the @fly-ai package.
✓ 凭证需求
The skill requests no environment variables, credentials, or special config paths. That is proportionate to its function. Caveat: the runbook/logging may record raw user input into a local file if filesystem writes are available, which has privacy implications (not a direct credential request but worth noting).
ℹ 持久化与权限
The skill is not marked always:true and allows normal autonomous invocation. It does suggest optionally appending execution logs to `.flyai-execution-log.json` if file writes are available — this grants persistent artifacts on disk but only for its own logs. No evidence it modifies other skills or global agent settings, but the lack of provenance for the external CLI increases risk if that CLI persists or modifies environment.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv3.2.02026/4/11
pocket-wifi 3.2.0 - Expanded and clarified critical execution rules, emphasizing exclusive use of flyai CLI output and strict validation of booking links. - Updated description to highlight expanded travel services: now covers flight booking, hotels, train/attraction tickets, itinerary planning, and more. - Added detailed workflow with step-by-step playbooks for WiFi rental scenarios and airport pickups. - Introduced strict parameter collection SOPs and multi-step self-test/proofing before output. - Strengthened rules against using training data or fabricated information in all responses.
● 可疑
安装命令
点击复制官方npx clawhub@latest install pocket-wifi
镜像加速npx clawhub@latest install pocket-wifi --registry https://cn.longxiaskill.com