Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Trip Coupon 出行优惠券隐藏券-支持滴滴出行、携程礼包(机票、酒店、门票)

获取出行优惠券,支持滴滴出行大礼包、携程礼包天天领(酒店、机票、门票)。返回领取链接和二维码图片,用户可点击链接或扫描二维码在微信中领取优惠。

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 26 · 0 current installs · 0 all-time installs
MIT-0
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description match the implementation: SKILL.md and scripts request a GET to an external coupon API and return coupon URLs and QR image URLs. The included Python scripts implement exactly that. However the API and content hosts (agskills.moontai.top, moontai-static.oss-cn-shenzhen.aliyuncs.com, open.cdyunzhanxinxi.com) are third‑party/unofficial for DiDi/Ctrip, which should be validated by the user.
!
Instruction Scope
Instructions are narrowly scoped to calling the external API and presenting returned coupon_url and coupon_qrcode_img_url exactly as returned. The directive to 'strictly present API URLs unmodified' prevents sanitization or safety checks and increases risk if the API returns malicious or tracking links. SKILL.md does not instruct reading local files or credentials (good), but the prohibition on modifying links is security‑relevant.
Install Mechanism
No install spec (instruction-only), so nothing is written to disk by an installer. The package does include Python scripts that use the requests library, but no dependency/install metadata is declared—users running the scripts must have Python + requests available. No direct download/install from unknown URLs is present in metadata.
Credentials
The skill requests no environment variables, no credentials, and no config paths. Network access is required (declared). The absence of credentials is proportionate to the stated purpose. However, network calls go to an unknown third‑party API which could return arbitrary content.
Persistence & Privilege
Skill is not forced-always, does not request elevated agent privileges, and does not attempt to modify other skills or system configuration. Autonomous invocation is allowed (platform default) but not combined with other high privileges.
What to consider before installing
This skill fetches coupon links and QR images from an external API and explicitly instructs agents to display the returned URLs exactly as received. Before installing or using it, verify the API/host ownership (agskills.moontai.top, moontai-static.oss-cn-shenzhen.aliyuncs.com, open.cdyunzhanxinxi.com) — they are not official DiDi/Ctrip domains. Treat the returned links/QRs like untrusted URLs: do not auto-open them, inspect the destination first, and avoid entering credentials on landing pages. Consider running the included scripts in an isolated environment (local machine or sandbox), review the GitHub repo history/maintainer, and add URL-safety checks or link-sanitization if you will present links to end users. Also note the Python scripts use the requests library though dependencies aren’t declared; ensure your runtime environment has required libs and that you are comfortable granting outbound network access.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.1
Download zip
latestvk9763z51p5gpxe2zfvjep8kcd1830g3y

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

出行优惠券

Overview

此skill通过调用出行优惠券API接口,获取滴滴出行大礼包和携程礼包天天领(包含酒店、机票、门票)的优惠券信息。返回优惠券链接(coupon_url)和二维码图片(coupon_qrcode_img_url),供用户点击链接或扫描二维码领取优惠。

Quick Start

  1. 调用API: GET https://agskills.moontai.top/coupon/trip
  2. 解析返回的JSON数据,包含2个主要对象
  3. 按平台分类展示优惠券信息
  4. 重要: coupon_url建议在微信中打开,或使用微信扫描二维码图片

API配置

基础信息

配置项
API地址https://agskills.moontai.top/coupon/trip
认证方式无需认证
请求方法GET
返回格式JSON

响应数据结构

[
  {
    "title":"滴滴出行大礼包,打车券天天领",
    "coupon_url":"https://open.cdyunzhanxinxi.com/link/100115769b7d6d0087771002k13YX0SY",
    "coupon_qrcode_img_url":"https://moontai-static.oss-cn-shenzhen.aliyuncs.com/coupon-trip.png",
    "guideline":"点击链接领券(建议用微信打开),或使用微信扫描二维码领券"
  },
  {
    "title":"携程礼包天天领,酒店、机票、门票",
    "coupon_url":"https://open.cdyunzhanxinxi.com/link/100012769b7d927254211000c1x1UOrw",
    "coupon_qrcode_img_url":"https://moontai-static.oss-cn-shenzhen.aliyuncs.com/trip-xiecheng.png",
    "guideline":"点击链接领券(建议用微信打开),或使用微信扫描二维码领券"
  }
]

响应字段说明

字段路径类型说明
[].titleString优惠券标题名称
[].coupon_urlString优惠券链接URL,建议在微信中打开
[].coupon_qrcode_img_urlString优惠券二维码图片URL,建议使用微信扫码
[].guidelineString使用说明和领取指南

任务类型

1. 获取全平台出行优惠券

调用API获取滴滴出行和携程礼包的优惠券,按平台分类展示给用户。

2. 获取特定平台优惠券

根据用户指定平台,返回该平台的专属优惠券:

  • 滴滴出行 → 滴滴出行大礼包
  • 携程 → 携程礼包天天领(酒店、机票、门票)

3. 展示优惠券链接

提供优惠券链接URL,建议用户在微信中打开。

4. 展示优惠券二维码

提供优惠券二维码图片,建议用户使用微信扫描。

When to use(触发场景)

此skill在以下场景下使用:

  1. 用户询问出行优惠相关信息,例如:

    • "有什么出行优惠券?"
    • "帮我找打车红包"
    • "出行券怎么领?"
    • "滴滴出行有什么优惠?"
    • "携程优惠券在哪领?"
    • "酒店、机票、门票优惠"
    • "旅行省钱"
  2. 用户明确指定某一平台的出行优惠券,例如:

    • "我要滴滴出行优惠券"
    • "携程礼包优惠"
    • "酒店优惠券"
    • "机票优惠券"
  3. 用户遇到优惠券链接问题,例如:

    • "优惠券链接打不开"
    • "优惠券怎么用不了"

重要规则

coupon_url 和 coupon_qrcode_img_url 处理规则

严格原样呈现API返回的URL链接和二维码链接!

  • 不允许修改URL链接的任何部分
  • coupon_url建议在微信中打开
  • coupon_qrcode_img_url建议使用微信扫码
  • 必须原样从API获取、原样呈现给用户

使用示例

示例1: 用户请求出行优惠

用户输入: "有什么出行优惠券可以领?"

处理流程:

  1. 调用 GET https://agskills.moontai.top/coupon/trip
  2. 解析返回的JSON数据
  3. 按平台分类展示(滴滴出行、携程礼包)
  4. 每条优惠券展示:标题、优惠券链接、领取说明
  5. 同时展示二维码图片

输出格式:

【滴滴出行】
1. 滴滴出行大礼包,打车券天天领
   优惠券链接:https://open.cdyunzhanxinxi.com/link/100115769b7d6d0087771002k13YX0SY
   (建议用微信打开)
   二维码图片:https://moontai-static.oss-cn-shenzhen.aliyuncs.com/coupon-trip.png
   (使用微信扫描二维码领券)
   使用说明:点击链接领券(建议用微信打开),或使用微信扫描二维码领券

【携程礼包】
2. 携程礼包天天领,酒店、机票、门票
   优惠券链接:https://open.cdyunzhanxinxi.com/link/100012769b7d927254211000c1x1UOrw
   (建议用微信打开)
   二维码图片:https://moontai-static.oss-cn-shenzhen.aliyuncs.com/trip-xiecheng.png
   (使用微信扫描二维码领券)
   使用说明:点击链接领券(建议用微信打开),或使用微信扫描二维码领券

示例2: 用户指定平台

用户输入: "帮我找滴滴的出行优惠券"

处理流程:

  1. 调用API获取数据
  2. 仅提取滴滴出行相关的优惠券
  3. 按顺序展示滴滴出行优惠券

错误处理

  • API调用失败时,返回友好提示:"暂时无法获取优惠券信息,请稍后重试"
  • 网络异常时,提供错误原因和重试建议
  • 数据解析异常时,提示用户联系技术支持

Edge cases(边缘场景处理)

1. API调用失败

  • 场景: 网络超时、服务器不可用
  • 处理: 返回友好提示"暂时无法获取优惠券信息,请稍后重试",并建议用户稍后再试

2. 数据结构变化

  • 场景: API返回的数据结构与文档不符
  • 处理: 尽量解析可用字段,对无法解析的部分给出提示

3. 特定平台无优惠券

  • 场景: 某一平台(如携程)暂无优惠券
  • 处理: 跳过该平台,仅展示有优惠券的平台,并说明"该平台暂无优惠券"

4. 用户无法打开coupon_url

  • 场景: 用户反馈优惠券链接无法打开
  • 处理: 建议用户在微信中打开链接,或使用微信扫描二维码

5. 二维码图片无法加载

  • 场景: 二维码图片URL无法访问
  • 处理: 提示用户使用优惠券链接,建议在微信中打开

Resources

scripts/

  • fetch_coupons.py - 获取出行优惠券的主脚本

references/

  • api_documentation.md - 完整的API接口文档

Files

7 total
Select a file
Select a file to preview.

Comments

Loading comments…