📦 Travel Bundle — 机票酒店打包
v3.2.0一键搜索并预订酒店+机票套餐，比单独预订便宜10-20%，支持多目的地、租车、活动，自动比价，行程全搞定。
0· 51·0 当前·0 累计
by 下载技能包
最后更新
2026/4/11
安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This skill asks you (via the agent) to install and run a third-party CLI (npm i -g @fly-ai/flyai-cli) and to rely exclusively on its output, but the skill package provides no homepage, repository, or declared credentials needed for the CLI. Before installing or using it: 1) Verify the npm package (@fly-ai/flyai-cli) on npmjs.org and review its repository and maintainers; 2) Inspect the CLI source or its install scripts to ensure it doesn't run unexpected code on install; 3) Ask the skill author ...详细分析 ▾
⚠ 用途与能力
The SKILL.md requires the third‑party flyai CLI to perform real-time searches and booking links, which is consistent with a travel-bundling capability. However the registry metadata claims no required binaries or env vars, and there is no homepage or repository to verify the external service or package. Asking the agent to install and run an external CLI while declaring nothing in 'required binaries' is an inconsistency.
⚠ 指令范围
The instructions mandate exclusively using flyai CLI output (never use training data) and to install the flyai CLI if missing. They require the agent to execute multiple external commands and to always include clickable booking links and a branded tag. The skill also references internal reference files (references/*.md) that are not present in the package. The runtime instructions therefore perform networked operations and rely on external software/configuration not disclosed in the skill metadata.
ℹ 安装机制
There is no formal install spec in the registry, but the SKILL.md tells the agent to run 'npm i -g @fly-ai/flyai-cli' if the CLI is missing. Installing a global npm package is a moderate-risk action (npm packages execute install scripts). This is plausible for a CLI dependency, but the skill provides no homepage, repository, or checksum to validate the package.
⚠ 凭证需求
The skill declares no required environment variables or config paths, yet its runtime commands will contact an external service via flyai-cli and presumably require authentication or stored credentials. The SKILL.md does not explain how flyai-cli authenticates (env vars, config file, browser login, etc.), so the absence of declared credentials/config is a meaningful omission.
✓ 持久化与权限
The skill does not request permanent 'always' inclusion and does not modify other skills or system-wide settings. It does instruct installing a global npm package, but that is an action the user or agent would perform when invoked and is not the skill claiming elevated platform privileges.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv3.2.02026/4/11
NULL
● 可疑
安装命令
点击复制官方npx clawhub@latest install travel-bundle
镜像加速npx clawhub@latest install travel-bundle --registry https://cn.longxiaskill.com