Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Airport Transfer Guide
v1.0.0Guide travelers through international airport transit connections step-by-step with Chinese-language instructions, terminal maps/photos, live queue or crowd...
⭐ 0· 30·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (airport transit guidance with maps, crowd data, baggage checks) align with requested artifacts: python3, outbound HTTPS access to aggregator sites and official airport sites, optional Chrome for screenshots. The included airport registry and data-fetching script match the stated capabilities; no unrelated binaries or secrets are requested.
Instruction Scope
SKILL.md instructs the agent to run the included fetch_transit_context.py to gather images, crowd/wait data and baggage notes from public sites (ifly.com, flightqueue.com, airport official sites). It explicitly requires source attribution and honest fallbacks. The runtime will perform outbound HTTP(S) requests and may invoke a local Chrome/Chromium via subprocess for CDP screenshots; SKILL.md also references other tools/skills (flight-helper:transit_guide, flight-helper:baggage_rules) which are not declared in metadata — verify those integrations exist. No instructions ask to read unrelated local files or environment secrets.
Install Mechanism
No install spec; instruction-only plus a pure-Python stdlib script. No downloads from arbitrary URLs or packaged installers. This minimizes write-to-disk and supply-chain risk beyond the included files.
Credentials
The skill declares no required environment variables or credentials. Network access to public aggregator and official airport sites is necessary for live data; this is proportionate to the described functionality. There are no requests for unrelated secrets or config paths.
Persistence & Privilege
always=false and the skill does not request persistent system-wide privileges. It may store CDP screenshots or JSON output locally when the script runs (normal for a data-fetching tool) but does not modify other skills or system configs.
Assessment
This skill appears internally consistent, but review these points before installing:
- Network access: the included script will make outbound HTTPS requests to aggregator sites (ifly.com, flightqueue.com, flightradar24, and many airport official pages). Expect the agent to fetch and embed images and scraped text when invoked.
- Local Chrome use: the script can optionally call a local Chrome/Chromium for CDP screenshots via subprocess. Confirm you are comfortable allowing the skill to launch a local browser binary (it does not require credentials but will create local screenshots/files).
- Check cross-skill references: SKILL.md references flight-helper:transit_guide and flight-helper:baggage_rules; verify those tools exist and are trusted in your environment or adjust the instructions to avoid unexpected remote calls.
- Audit the script if you need assurance: fetch_transit_context.py appears to use urllib and HTML parsing and prints warnings on failures; scan it for any unexpected network destinations or subprocess invocations beyond Chrome for screenshots. There are no obvious hardcoded private endpoints or credential-exfil patterns.
- Privacy: the skill may embed third-party images and links in outputs. If you plan to handle sensitive itineraries or passenger data, be aware that the skill fetches public pages but does not declare protections for user-supplied personal data — avoid including unnecessary PII in requests.
Overall: functionality and requested capabilities are proportionate to the stated purpose; if you need higher assurance, manually review the full script (especially any subprocess/Chrome invocation paths) before enabling autonomous use.Like a lobster shell, security has layers — review code before you run it.
latestvk972zzc37mfk65x9bc0008nm8n841v45
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
Binspython3
