Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Family Trip Planner
v0.1.0Recommend family-friendly trip destinations with budgets, create daily child-focused itineraries, and offer packing lists and safety tips for family vacations.
⭐ 0· 56·0 current·0 all-time
byhaidong@harrylabsj
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The declared purpose (family trip planning) aligns with the code: data-driven destination recommendations, itineraries, packing lists and safety tips. However, there are multiple handler implementations (handler.py and scripts/handler.py) that return different JSON schemas and clawhub.json and skill.json point at different entry files. This mismatch is disproportionate to the simple stated purpose and could cause unexpected behavior depending on which handler the platform runs.
Instruction Scope
SKILL.md describes a JSON output schema including destinationRecommendations[], dailyItinerary[], budgetEstimate, packingList, safetyTips. The top-level handler.py implements that schema (including budgetEstimate and safetyTips). But scripts/handler.py — referenced by clawhub.json — returns a different schema (budgetBreakdown, kidFriendlyAttractions, packingList) and slightly different keys. The runtime instructions and available code are therefore inconsistent: the agent may produce or expect a different structure than documented.
Install Mechanism
No install spec and no external downloads or binaries. All code is local and static; there are no network calls, installers, or third-party package installs in the manifest. This is low risk from an install mechanism perspective.
Credentials
The skill requests no environment variables, no credentials, and references only local static data structures. There is no access requested to external services or unrelated credentials, which is proportionate for the described functionality.
Persistence & Privilege
always:false and no special persistence or system-wide configuration changes are requested. The skill does not modify other skills or agent settings in the package; persistence/privilege levels are appropriate.
What to consider before installing
This skill appears to implement the advertised trip-planning functionality and does not request secrets or network access, but the package is inconsistent: there are two handler files that produce different JSON outputs and two different entrypoints declared (clawhub.json -> scripts/handler.py vs skill.json -> handler.py). Before installing or enabling autonomous use, ask the publisher which handler is intended, or run the package locally to confirm the actual runtime output and that it matches the SKILL.md schema. Also verify the platform will run the expected entrypoint. If you rely on the documented output keys (budgetEstimate, safetyTips), ensure the deployed handler returns them; otherwise downstream code or integrations may break or leak unexpected data. Finally, prefer skills with a known source/homepage or a verified author; the package author is 'Harry' but no homepage or repository is provided.Like a lobster shell, security has layers — review code before you run it.
latestvk9702a88v28c3pzhmh6h5hesh984dm2v
License
MIT-0
Free to use, modify, and redistribute. No attribution required.