Ski Assistant
v6.0.1Global ski resort assistant covering 854 resorts across 40+ countries. Plan trips, compare prices, analyze your form, and find early-bird deals. 全球滑雪助手，覆盖 85...
⭐ 1· 311·1 current·1 all-time
bywjy@wjyhahaha
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description match the packaged assets: a resorts DB, search strategies, modules for pricing, coaching, discovery, and five Python tools that implement network lookups and card generation. Requested resources (local DB, webfetch, websearch, optional flyai) are appropriate for trip planning, pricing and coaching.
Instruction Scope
SKILL.md explicitly instructs the agent to read/write files in ~/.ski-assistant (user_profile.json, records.json, watchlist.json, upcoming_trips.json, price_history.json, custom_resorts.json). It also instructs calling Python tools and external APIs (Open-Meteo, exchangerate-api, Overpass/Nominatim, raw.githubusercontent.com, websearch). These operations are coherent with the described features but are material: installing will give the skill local storage and network access. The README/skill require the agent to run python3 scripts, but the skill metadata lists no required binaries — an inconsistency to note.
Install Mechanism
There is no install spec (instruction-only skill with bundled code). The included Python files are executed via Bash(python3 ...) per SKILL.md; nothing is downloaded from arbitrary hosts at install time. The database update feature can pull from raw.githubusercontent.com when the update-db tool is invoked, which is a reasonable, documented data-sync behavior.
Credentials
The skill requests no environment variables or secret credentials beyond an optional SKI_ASSISTANT_DATA_DIR for changing the data directory. That matches its stated functionality. It does not require unrelated cloud keys or tokens.
Persistence & Privilege
The skill persists user data under ~/.ski-assistant and may create scheduled reminders (cron) only with explicit user consent and platform support. Persistent storage and optional cron tasks are within the skill's scope (saving coaching records, watchlists, upcoming trips), but users should be aware these files are written to their home directory and that creating system cron jobs (if allowed) can have broader effects.
Assessment
This skill appears to be what it advertises, but check a few practical things before installing: 1) It runs Python scripts (SKILL.md and examples use python3) yet the metadata doesn't list python3 as a required binary — ensure your environment has python3 and inspect the tools/*.py files if you want to verify behavior. 2) The skill will read/write files under ~/.ski-assistant (user profile, coaching records, watchlist, price history); review those files and backup sensitive data if needed. 3) The skill makes outbound network calls (Open‑Meteo, exchangerate-api, Overpass/Nominatim, raw.githubusercontent.com, WebSearch/WebFetch); if you have network restrictions or privacy concerns, consider that web queries and DB updates will be performed when you invoke relevant features. 4) The skill may create scheduled reminders (cron) only after you explicitly grant consent — be cautious when allowing creation of system cron jobs and review any generated crontab entries. 5) If you plan to use price-updating (update-db) or auto-sync, review the source of remote files (raw.githubusercontent.com) before accepting updates. If you want higher assurance, open and review the tools/*.py scripts to confirm they do only the documented actions and don't exfiltrate data.Like a lobster shell, security has layers — review code before you run it.
latestvk979skvjfwhpz657c792rjzm7d84n23t
License
MIT-0
Free to use, modify, and redistribute. No attribution required.