Night Market Guide — 夜市美食地图
v3.2.0一键发现全球夜市、美食街与本地深夜食堂，精准定位街头小吃与特色宵夜，助你解锁最地道的夜晚味蕾体验。
0· 52·0 当前·0 累计
by @xiejinsong下载技能包
最后更新
2026/4/11
安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
Key things to consider before installing: 1) The SKILL.md requires you to globally install and run @fly-ai/flyai-cli from npm at runtime — verify that package on the npm registry (author, weekly downloads, source repository, maintainers, and recent release) before allowing installation or run the CLI in a sandbox. 2) The skill advertises booking/Fliggy capabilities but declares no credentials; expect that the CLI may later prompt for API keys or account logins — don’t provide secrets until you v...详细分析 ▾
ℹ 用途与能力
The declared purpose (find night markets / food streets) aligns with the CLI commands shown (flyai search-poi). However the description also claims many extra travel features (flight booking, hotels, travel insurance, 'powered by Fliggy') that are not supported or justified by the SKILL.md commands or by any declared credentials. The extra capabilities are disproportionate to the visible instructions.
⚠ 指令范围
The SKILL.md mandates that every answer must come from the flyai CLI output and instructs the agent to install and run npm i -g @fly-ai/flyai-cli if the CLI is missing. It also references several local doc files (references/*.md) that are not present in the skill manifest. The file-missing and the strict re-execution/self-test rules (requiring a [Book]({detailUrl}) link and re-running on any deviation) could force repeated installs/external calls or create an execution loop. The rule 'NEVER answer from training data' gives the agent no fallback and could lead to failure or repeated network activity.
⚠ 安装机制
Although the registry metadata has no formal install spec, the runtime instructions require a global npm install of @fly-ai/flyai-cli. Installing an unvetted global npm package is potentially high-impact (writes to disk, installs binaries that will be invoked). The SKILL.md provides no pinned version, no source verification, and no alternative validated install path, which is disproportionate for a simple lookup skill.
ℹ 凭证需求
The skill declares no required environment variables or credentials, which is good. However it advertises booking and Fliggy-powered capabilities that normally require API credentials, yet no credential fields or instructions for authentication are declared. The flyai CLI itself may prompt for or require credentials at runtime — this is not surfaced in the manifest and could lead to unexpected credential entry.
ℹ 持久化与权限
The skill is not always-on and does not request elevated platform privileges. That said, its instructions involve installing a global CLI binary (npm i -g), which persists on the host outside the agent sandbox; this persistence is not declared in the registry install spec and is worth noting though it is not a direct skill-level permission request.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv3.2.02026/4/11
NULL
● 可疑
安装命令
点击复制官方npx clawhub@latest install night-market-guide
镜像加速npx clawhub@latest install night-market-guide --registry https://cn.longxiaskill.com镜像同步中