China Travel Planner
v1.0.0Plan and optimize travel within China using flyai / Fliggy search capabilities plus public metro-network data when needed. Use when the user wants a domestic...
⭐ 0· 58·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name, description, SKILL.md, README, and the included scripts/pages align: the repo provides itinerary generation, subway-data utilities, Wikimedia image search, and page rendering as described. One minor inconsistency: the skill expects to call flyai/Fliggy (the SKILL.md and README state a dependency on the 'flyai' skill) but the registry metadata does not list that dependency explicitly or declare any required credentials; the README does call out that flyai should be installed. Functionally the pieces match the stated purpose.
Instruction Scope
SKILL.md instructs using flyai CLI commands for flights/hotels/POIs and using public metro data for transit-aware planning. The runtime instructions focus on planning tasks and preparing structured JSON / optional HTML pages. There are no instructions to read unrelated system files or to exfiltrate arbitrary data. The skill will perform network requests to external services (flyai/Fliggy, Wikimedia, metro-data sources) which is expected for its purpose.
Install Mechanism
No install spec is provided (instruction-only skill with bundled helper scripts). That minimizes automatic code downloads or opaque install steps. The repository includes scripts that, if executed, will fetch remote data (e.g., subway data, images) and write generated pages to disk — expected for a page generator but worth reviewing before running.
Credentials
The skill declares no required environment variables or credentials. However, the SKILL.md and README rely on the 'flyai' integration (Fliggy searches, flight/hotel queries) which typically requires credentials or another skill to provide them; those credentials are not declared here. This omission is likely because 'flyai' is a separate skill that provides auth, but you should confirm that flyai is installed and that its credentials are managed separately. No other unrelated secrets are requested.
Persistence & Privilege
The skill does not request 'always: true', does not declare system-wide modifications, and is user-invocable only. It may generate files (HTML, JSON) in the working directory when used, which is normal for a page generator and not a privilege escalation.
Assessment
This appears to be a coherent China trip-planning skill that uses flyai/Fliggy and public metro data to produce itineraries and optional HTML pages. Before installing or running it: (1) Confirm the 'flyai' integration is installed and trusted—flyai/Fliggy calls require network access and likely use separate credentials; the skill itself doesn't declare those creds. (2) Review the included scripts (fetch_subway_data.py, tpf-init.sh, tpf-*.py) before executing them — they fetch remote data and write files to disk. (3) Be aware the skill will make outbound network requests (search APIs, Wikimedia, Unsplash links in examples). (4) If you only want lightweight planning, avoid running the page-generation/init scripts; you can use the SKILL.md guidance with the flyai integration directly. If you want higher assurance, ask the author to declare the dependency on the flyai skill in metadata and to document any external endpoints the helper scripts contact.Like a lobster shell, security has layers — review code before you run it.
latestvk970p7e9hsy90q8jwt0xs5qe9d83v090
License
MIT-0
Free to use, modify, and redistribute. No attribution required.