ZappushZappush
SkillsUse CasesBenchmarkCommunitySign In
      Back to Skills
      wjyhahaha

      Safety Report

      Ski Assistant

      @wjyhahaha

      Global ski resort assistant covering 854 resorts across 40+ countries. Plan trips, compare prices, analyze your form, and find early-bird deals. 全球滑雪助手,覆盖 85...

      362Downloads
      1Installs
      1Stars
      34Versions
      Networking & DNS2,106

      Security Analysis

      medium confidence
      Clean0.08 risk

      The skill is internally consistent with a ski-resort assistant: it bundles local data, read/write user files under ~/.ski-assistant, and runs included Python tools and web queries — the main inconsistency is it doesn't declare Python as a required binary and it can create reminders/cron tasks only with user consent.

      Apr 11, 202638 files2 concerns
      Purpose & Capabilityok

      Name/description match the packaged assets: a resorts DB, search strategies, modules for pricing, coaching, discovery, and five Python tools that implement network lookups and card generation. Requested resources (local DB, webfetch, websearch, optional flyai) are appropriate for trip planning, pricing and coaching.

      Instruction Scopenote

      SKILL.md explicitly instructs the agent to read/write files in ~/.ski-assistant (user_profile.json, records.json, watchlist.json, upcoming_trips.json, price_history.json, custom_resorts.json). It also instructs calling Python tools and external APIs (Open-Meteo, exchangerate-api, Overpass/Nominatim, raw.githubusercontent.com, websearch). These operations are coherent with the described features but are material: installing will give the skill local storage and network access. The README/skill require the agent to run python3 scripts, but the skill metadata lists no required binaries — an inconsistency to note.

      Install Mechanismok

      There is no install spec (instruction-only skill with bundled code). The included Python files are executed via Bash(python3 ...) per SKILL.md; nothing is downloaded from arbitrary hosts at install time. The database update feature can pull from raw.githubusercontent.com when the update-db tool is invoked, which is a reasonable, documented data-sync behavior.

      Credentialsok

      The skill requests no environment variables or secret credentials beyond an optional SKI_ASSISTANT_DATA_DIR for changing the data directory. That matches its stated functionality. It does not require unrelated cloud keys or tokens.

      Persistence & Privilegenote

      The skill persists user data under ~/.ski-assistant and may create scheduled reminders (cron) only with explicit user consent and platform support. Persistent storage and optional cron tasks are within the skill's scope (saving coaching records, watchlists, upcoming trips), but users should be aware these files are written to their home directory and that creating system cron jobs (if allowed) can have broader effects.

      Guidance

      This skill appears to be what it advertises, but check a few practical things before installing: 1) It runs Python scripts (SKILL.md and examples use python3) yet the metadata doesn't list python3 as a required binary — ensure your environment has python3 and inspect the tools/*.py files if you want to verify behavior. 2) The skill will read/write files under ~/.ski-assistant (user profile, coaching records, watchlist, price history); review those files and backup sensitive data if needed. 3) The skill makes outbound network calls (Open‑Meteo, exchangerate-api, Overpass/Nominatim, raw.githubusercontent.com, WebSearch/WebFetch); if you have network restrictions or privacy concerns, consider that web queries and DB updates will be performed when you invoke relevant features. 4) The skill may create scheduled reminders (cron) only after you explicitly grant consent — be cautious when allowing creation of system cron jobs and review any generated crontab entries. 5) If you plan to use price-updating (update-db) or auto-sync, review the source of remote files (raw.githubusercontent.com) before accepting updates. If you want higher assurance, open and review the tools/*.py scripts to confirm they do only the documented actions and don't exfiltrate data.

      Latest Release

      v6.0.1

      - Ski resort database updated: now covers 854 resorts (was 900), including 178 search aliases; China coverage now 470 resorts (was 482). - Database and strategy files reduced in size and optimized; region strategy coverage improved to 96.3%. - User data: coaching records format changed from JSON Lines to standard JSON array. - Docs and module references updated to reflect new database stats, file formats, and covered regions. - Various module and reference corrections to align with streamlined datasets and improved coverage.

      More by @wjyhahaha

      Quick Learn

      3 stars

      self-improving-agent

      @pskoett · 1,456 stars

      Gog

      @steipete · 672 stars

      Tavily Web Search

      @arun-8687 · 620 stars

      Find Skills

      @JimLiuxinghai · 529 stars

      Proactive Agent

      @halthelobster · 426 stars

      Published by @wjyhahaha on ClawHub

      Zappush© 2026 Zappush
      HomeGuaranteeSupport

      Something feels unusual? We want to help: [email protected]