🚄 12306 Query — 查火车票
v1.0.0调用中国铁路12306官方接口，实时查询列车时刻表、余票数量及车站信息，支持高铁/动车/普速列车，一句话搞定火车票信息检索。
0· 130·3 当前·3 累计
by @zhangsaizz下载技能包
最后更新
2026/3/21
安全扫描
OpenClaw
安全
high confidenceNULL
评估建议
This skill appears to do exactly what it says: it requires Node.js and will make HTTPS requests to kyfw.12306.cn / www.12306.cn at runtime, then cache station data in data/stations.json and optionally write HTML output files in the skill directory or a user-specified path. No credentials are requested. Before installing, ensure you trust the skill source (there are small metadata inconsistencies between the registry Owner ID, _meta.json, and README install path), confirm you have Node >= 18 so t...详细分析 ▾
✓ 用途与能力
Name/description ask for 12306 queries and the package requires only Node and includes two scripts that call 12306 endpoints and a station cache. Required binaries (node) and bundled station data are appropriate. Minor bookkeeping inconsistency: _meta.json ownerId and the registry Owner ID/README install path differ (suggests a forked/copy origin) but this does not affect functionality.
✓ 指令范围
SKILL.md instructs running the included node scripts; the scripts perform only the advertised actions: fetching station_name.js and leftTicket/query from 12306, parsing results, printing JSON/MD or writing an HTML file, and caching stations.json. The scripts write/read a local cache (data/stations.json) and output HTML/JSON as described; they do not read other system files or access unrelated environment variables or external endpoints.
✓ 安装机制
No install spec — instruction-only plus included source files. Nothing is downloaded at install time; network access occurs at runtime (fetching 12306). This is low-risk and proportionate to the skill.
✓ 凭证需求
The skill requests no environment variables or credentials. It only uses network access to 12306 and local filesystem access to cache station data and save HTML output — both expected for the stated purpose.
✓ 持久化与权限
always:false and no requests to persist or modify other skills or agent-wide configuration. The only persistence is a local cache file under the skill's data directory (data/stations.json), which is appropriate for performance.
⚠ scripts/stations.mjs:3
File read combined with network send (possible exfiltration).
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/21
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install 12306-query
镜像加速npx clawhub@latest install 12306-query --registry https://cn.longxiaskill.com