Travel Frog 旅行青蛙

PassAudited by ClawScan on May 1, 2026.

Overview

This looks like a coherent virtual travel-frog game; it keeps game memories and can send autonomous updates/photos, but those behaviors are disclosed and aligned with the purpose.

Install this if you want a persistent autonomous virtual pet that runs a local Python engine, stores game diaries/memories, sends travel notifications, and may use separate image-generation skills for postcards/photos. Review those image-generation dependencies separately and avoid putting sensitive personal details into the frog’s memory.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The skill will run local commands and append game diary files during normal use.

Why it was flagged

The skill directs the agent to use exec for the local Python engine and diary appends. This is disclosed and scoped to game behavior, but users should know local commands are part of normal operation.

Skill content
每次启动 ... exec 运行 `python3 skills/travel-frog/scripts/frog_engine.py status` ... 日记 ... 用 `exec` 的 `echo >> file`
Recommendation

Install only if you are comfortable with the skill running its local Python engine and writing its own game files.

What this means

Generating images may depend on separate OpenAI/Gemini image-generation skills and their configuration.

Why it was flagged

Photo and postcard generation references other local skills that are not part of this artifact set. This is purpose-aligned, but those separate skills and provider credentials need their own trust review.

Skill content
python3 skills/openai-image-gen/scripts/gen.py ... uv run skills/nano-banana-pro/scripts/generate_image.py
Recommendation

Review and trust the referenced image-generation skills separately before enabling photo/postcard generation.

What this means

Things you tell the frog about places or recommendations may persist and influence future trips.

Why it was flagged

The skill intentionally stores user-provided travel tips and learned world knowledge for future behavior. This is expected for the game, but persistent memory can carry forward mistaken or sensitive inputs.

Skill content
推荐地方 / 你应该去xxx | 记录到 `memory/friend_tips.md` ... 提到某个地方 | 解锁区域 + 记录印象到 world_knowledge.md
Recommendation

Avoid putting private information in travel tips, and edit or clear the memory files if you want to reset what the frog remembers.

What this means

The frog may send scheduled travel updates or postcards without a fresh user prompt when heartbeat events occur.

Why it was flagged

The skill is designed to act on heartbeat events, plan trips, and send notifications autonomously. This matches the advertised autonomous travel-frog behavior, but it is still persistent autonomous activity.

Skill content
cron 心跳(Travel Frog Engine)触发的所有自主行为,使用 `message` tool 发送消息 ... 有 events 就必须发通知 ... 默认动作是 `depart`
Recommendation

Use it only in channels where autonomous frog messages are welcome, and disable the skill or heartbeat behavior if you do not want unsolicited updates.