📦 TripGo API — 多模式出行
v1.0.1一站式 TripGo API 接口，聚合路线规划、公交时刻、行程管理与地理服务，支持步行、骑行、驾车、公交、共享交通等多模式组合出行，实时计算最优路径、碳排放与费用，为开发者提供城市级出行解决方案。
0· 296·0 当前·0 累计
by 下载技能包
最后更新
2026/3/1
安全扫描
OpenClaw
安全
high confidenceThe skill's files, required binaries, and environment variables are consistent with a TripGo API wrapper that issues HTTP requests using curl/jq and an API key.
评估建议
This skill appears to be a straightforward TripGo API wrapper. Before installing: 1) Only provide a TripGo API key you control (do not reuse other service credentials). 2) If you plan to use webhook registration, set TRIPGO_WEBHOOK_ALLOWLIST to restrict allowed callback domains and avoid setting TRIPGO_ALLOW_UNSAFE_WEBHOOK to true in production. 3) Review the included scripts if you will run them on your host, and ensure curl and jq (and python3 if you rely on pretty-printing) are present. 4) Be...详细分析 ▾
✓ 用途与能力
Name/description match the artifacts: bash scripts and reference docs implement TripGo routing, geocoding, trips, and public-transport endpoints. The only required credential (TRIPGO_API_KEY) and required binaries (curl, jq) are appropriate for this purpose.
✓ 指令范围
SKILL.md and sampled scripts instruct the agent to build JSON, URL-encode parameters, and call TripGo endpoints. Scripts validate/encode inputs with jq and urlencode; webhook registration is documented and SKILL.md recommends a webhook allowlist. I saw no instructions to read unrelated system files, sweep environment variables beyond those documented, or send data to unexpected external endpoints.
✓ 安装机制
No install spec is provided (instruction-only for installation), so nothing is downloaded or extracted during install. The shipped code are bash scripts and docs — no external install URLs or package downloads were used.
✓ 凭证需求
Only the TripGo API key (TRIPGO_API_KEY) is required in registry metadata; SKILL.md documents a couple of optional env vars (TRIPGO_BASE_URL, TRIPGO_WEBHOOK_ALLOWLIST, TRIPGO_ALLOW_UNSAFE_WEBHOOK) that are relevant to behavior. No unrelated credentials or broad secrets are requested.
✓ 持久化与权限
Skill is not forced-always (always:false) and does not request system-level persistence or modification of other skills. It can be invoked autonomously by the agent (disable-model-invocation:false), which is the platform default, and is not by itself a problem here.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.12026/3/1
Update display name to TripGo API
● 无害
安装命令
点击复制官方npx clawhub@latest install tripgo-api
镜像加速npx clawhub@latest install tripgo-api --registry https://cn.longxiaskill.com