Holiday Travel Ranker

PassAudited by ClawScan on May 10, 2026.

Overview

This appears to be a benign travel recommendation helper, but it will browse the web automatically and the provided package is incomplete compared with the files it references.

This looks safe to use for general travel planning. Before installing, verify the package source and check whether the missing scripts/reference files are included elsewhere; review them before execution. Expect the skill to use web search and create local Markdown/HTML reports, and avoid sharing sensitive personal details beyond what is needed for the recommendation.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Your departure city, holiday, budget, and preference details may be used in web searches, and the agent may continue research without asking again.

Why it was flagged

The skill explicitly says it will automatically use web browsing tools after the initial preference confirmation. This is expected for travel research, but it affects what user preferences may be sent in search queries.

Skill content
确认后立即进入 Phase 2,不再等待额外确认。... 通过 web_search 和 web_fetch 采集以下 8 个维度的数据。
Recommendation

Use non-sensitive travel preferences, ask for source citations, and request a pause before long searches if you want more control.

What this means

The skill may fail, improvise missing resources, or rely on additional files if they are added later.

Why it was flagged

The skill references helper scripts and reference files, but the supplied manifest contains only SKILL.md and the usage document. This creates an incomplete-package/provenance gap, although no hidden script content is present in the reviewed artifacts.

Skill content
见 `references/destinations.md`... 使用 `scripts/generate_report.py`... 使用 `scripts/generate_html.py`
Recommendation

Install only from a trusted complete package, and review any added scripts or reference files before running them.

What this means

Basic travel preferences could be shared across internal agent contexts during research.

Why it was flagged

The workflow explicitly splits research across subagents. The data appears limited to travel preferences and public research, but the artifacts do not define data-boundary rules for those subagents.

Skill content
使用并行 subagent 提高效率:- Subagent A... - Subagent B... - Subagent C...
Recommendation

Avoid including unnecessary personal identifiers, and ask the final report to summarize sources and assumptions.