China Travel Guide
v1.0.0Professional AI travel assistant for foreign visitors to China offering visa guidance, real-time transport info, payment support, live translation, and emerg...
⭐ 1· 88·0 current·0 all-time
by走过@1970168137
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name, description, and included data files (visa policies, emergency contacts, phrases, routes) align with a China travel guide. The SKILL.md requests web_search and image_analysis as tools for live translation/OCR and updating info, which is consistent with the described capabilities. No unrelated binaries, env vars, or config paths are requested.
Instruction Scope
SKILL.md stays within travel-assistant scope (visa guidance, translations, transport, emergency steps). It asks for basic user inputs (nationality, arrival date, duration) which are reasonable. One caveat: it emphasizes 'real-time information integrator' and proactive detection of issues but does not list or require authoritative external APIs or credentials; this could lead to stale or hallucinated 'real-time' answers unless the host platform's web_search is trusted. The instructions do not ask the agent to read unrelated system files or secrets.
Install Mechanism
Instruction-only skill with no install spec and no code files to execute. This is low-risk: nothing is downloaded or written to disk by the skill itself.
Credentials
The skill requires no environment variables, no credentials, and no config paths. Required inputs (nationality, dates) are proportionate to its function. There are no requests for API keys, tokens, or other secrets that would be disproportionate.
Persistence & Privilege
always is false and the skill is user-invocable. disable-model-invocation is false (normal). The skill does not request permanent presence or modification of other skills or system settings.
Scan Findings in Context
[unicode-control-chars] unexpected: A pre-scan flagged unicode control characters in SKILL.md which can be used for prompt-injection or to obfuscate content. The visible SKILL.md appears normal and coherent; this finding may be benign (e.g., stray invisibles in the file) but merits inspection of the raw file to confirm there is no hidden or maliciously placed control characters.
Assessment
This skill appears to be what it says: an offline instruction-only travel guide with useful local data and phrasecards. Before installing: 1) Verify the host platform's web_search/data sources if you rely on 'real-time' transport or visa updates—the skill itself has no trusted API keys. 2) Inspect the raw SKILL.md for invisible unicode control characters (the scanner flagged them); if present, ask the publisher why they are there. 3) Do not share highly sensitive secrets (bank credentials, passport scans, authentication tokens) with the skill; it legitimately asks for nationality and trip dates but not for credentials. 4) Independently confirm emergency numbers/visa rules with official government or embassy sources when acting on critical advice.Like a lobster shell, security has layers — review code before you run it.
latestvk974gygk5qsygmxxanyhz6w8ch839m9e
License
MIT-0
Free to use, modify, and redistribute. No attribution required.