📦 Flight Price Watcher — 机票降价盯盘
v2.2.2自动追踪机票价格，一旦降价立刻推送提醒，让你不错过最佳购票时机。支持多航线、多日期监控，无需手动刷新。
2· 182·0 当前·0 累计
by 下载技能包
最后更新
2026/4/2
安全扫描
OpenClaw
安全
medium confidenceThe skill is internally coherent for a flight-price-watching tool: it calls a CLI to fetch prices, stores tasks locally, and sends DingTalk alerts; nothing requested is disproportionate to that purpose, though it relies on shell commands which carry typical risks.
评估建议
This skill appears to do what it says: it calls a local FlyAI CLI to fetch flight data, stores tasks in data/tasks.json, and sends DingTalk notifications via openclaw message send. Before installing or running it:
- Only install the promised dependency (@fly-ai/flyai-cli) from a trusted source and verify that package's authenticity.
- Be aware the skill runs shell commands (flyai and openclaw) via child_process.exec; authors sanitize inputs, but executing commands always carries risk if an at...详细分析 ▾
✓ 用途与能力
Name/description match the implementation: code calls a FlyAI CLI to search flights, persists tasks to data/tasks.json, and uses openclaw message send to push DingTalk alerts. Declared dependency (@fly-ai/flyai-cli) and the SKILL.md installation guidance align with this purpose.
ℹ 指令范围
Runtime instructions focus on searching flights, creating tasks, and sending notifications. The SKILL.md explicitly instructs installing FlyAI CLI and using cron/OpenClaw for scheduling. It does not attempt to read unrelated system files or exfiltrate secrets. Note: the skill executes external commands (flyai, openclaw) and includes guidance to run npm installs; this is expected for a CLI-driven skill.
ℹ 安装机制
No install spec is provided for the platform (instruction-only), but package.json lists @fly-ai/flyai-cli as a dependency and SKILL.md tells users to run npm i @fly-ai/flyai-cli. That's proportionate, but the platform will not automatically fetch external archives — the user must install the CLI separately.
✓ 凭证需求
The skill requests no sensitive environment variables by default. package.json documents an optional DINGTALK_TARGET_ID for message targeting (reasonable). There are no unrelated credentials, and all required config paths are local (data/tasks.json).
✓ 持久化与权限
always:false and user-invocable defaults are used. The skill stores its own data under data/tasks.json and does not attempt to modify other skills or system-wide configs. No elevated or permanent platform privileges are requested.
⚠ scripts/task_manager.js:312
Shell command execution detected (child_process).
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv2.2.22026/4/2
**2.2.2 版本为完整功能版，提升体验与通知机制：** - 增加版本说明为“完整功能版：创建确认 + 首次检查 + 每日汇总 + 降价提醒 + 安全防护” - 文档底部更新为 2.2.2，反映最新版本状态 - 其他功能/用法/配置项/流程无变动
● 可疑
安装命令
点击复制官方npx clawhub@latest install flight-price-watcher
镜像加速npx clawhub@latest install flight-price-watcher --registry https://cn.longxiaskill.com