Global ski resort assistant covering 854 resorts across 40+ countries. Plan trips, compare prices, analyze your form, and find early-bird deals. 全球滑雪助手,覆盖 85...
Security Analysis
medium confidenceThe skill is internally consistent with a ski-resort assistant: it bundles local data, read/write user files under ~/.ski-assistant, and runs included Python tools and web queries — the main inconsistency is it doesn't declare Python as a required binary and it can create reminders/cron tasks only with user consent.
Name/description match the packaged assets: a resorts DB, search strategies, modules for pricing, coaching, discovery, and five Python tools that implement network lookups and card generation. Requested resources (local DB, webfetch, websearch, optional flyai) are appropriate for trip planning, pricing and coaching.
SKILL.md explicitly instructs the agent to read/write files in ~/.ski-assistant (user_profile.json, records.json, watchlist.json, upcoming_trips.json, price_history.json, custom_resorts.json). It also instructs calling Python tools and external APIs (Open-Meteo, exchangerate-api, Overpass/Nominatim, raw.githubusercontent.com, websearch). These operations are coherent with the described features but are material: installing will give the skill local storage and network access. The README/skill require the agent to run python3 scripts, but the skill metadata lists no required binaries — an inconsistency to note.
There is no install spec (instruction-only skill with bundled code). The included Python files are executed via Bash(python3 ...) per SKILL.md; nothing is downloaded from arbitrary hosts at install time. The database update feature can pull from raw.githubusercontent.com when the update-db tool is invoked, which is a reasonable, documented data-sync behavior.
The skill requests no environment variables or secret credentials beyond an optional SKI_ASSISTANT_DATA_DIR for changing the data directory. That matches its stated functionality. It does not require unrelated cloud keys or tokens.
The skill persists user data under ~/.ski-assistant and may create scheduled reminders (cron) only with explicit user consent and platform support. Persistent storage and optional cron tasks are within the skill's scope (saving coaching records, watchlists, upcoming trips), but users should be aware these files are written to their home directory and that creating system cron jobs (if allowed) can have broader effects.
Guidance
This skill appears to be what it advertises, but check a few practical things before installing: 1) It runs Python scripts (SKILL.md and examples use python3) yet the metadata doesn't list python3 as a required binary — ensure your environment has python3 and inspect the tools/*.py files if you want to verify behavior. 2) The skill will read/write files under ~/.ski-assistant (user profile, coaching records, watchlist, price history); review those files and backup sensitive data if needed. 3) The skill makes outbound network calls (Open‑Meteo, exchangerate-api, Overpass/Nominatim, raw.githubusercontent.com, WebSearch/WebFetch); if you have network restrictions or privacy concerns, consider that web queries and DB updates will be performed when you invoke relevant features. 4) The skill may create scheduled reminders (cron) only after you explicitly grant consent — be cautious when allowing creation of system cron jobs and review any generated crontab entries. 5) If you plan to use price-updating (update-db) or auto-sync, review the source of remote files (raw.githubusercontent.com) before accepting updates. If you want higher assurance, open and review the tools/*.py scripts to confirm they do only the documented actions and don't exfiltrate data.
Latest Release
v6.0.1
- Ski resort database updated: now covers 854 resorts (was 900), including 178 search aliases; China coverage now 470 resorts (was 482). - Database and strategy files reduced in size and optimized; region strategy coverage improved to 96.3%. - User data: coaching records format changed from JSON Lines to standard JSON array. - Docs and module references updated to reflect new database stats, file formats, and covered regions. - Various module and reference corrections to align with streamlined datasets and improved coverage.
More by @wjyhahaha
Published by @wjyhahaha on ClawHub