remote-work-travel

Book flights for remote work travel and workation destinations. Also supports: flight booking, hotel reservation, train tickets, attraction tickets, itinerar...

This skill is instruction-only but tells the agent to globally install and run an external npm package (@fly-ai/flyai-cli) at runtime — the package's source and trustworthiness are not provided. Before installing: (1) verify the package on the npm registry and its linked source repository (GitHub/etc.), review maintainer and recent publish history; (2) confirm the relationship between 'flyai' and the claimed 'Fliggy (Alibaba Group)' branding; (3) prefer running such installs in a sandbox or container rather than on your primary machine because global npm installs run arbitrary code; (4) ask the skill author to supply a concrete install spec (trusted release URL, checksum, or repository) or to declare required binaries in the registry metadata; (5) if you cannot verify the package provenance, do not install — consider using an alternative travel integration with known, auditable tooling. Additional information that would change this assessment: a homepage/repository URL for the skill and for the @fly-ai/flyai-cli package, a vetted install spec (signed release or GitHub release), or registry metadata updated to declare the CLI requirement and its trusted source.

Type: OpenClaw Skill Name: remote-work-travel Version: 3.2.0 The skill mandates the global installation of an external npm package (@fly-ai/flyai-cli) and executes shell commands using user-provided input for flight searches in SKILL.md and references/playbooks.md. While these capabilities are aligned with the stated travel booking purpose, the requirement for global software installation and the potential for shell injection via unsanitized parameters (e.g., --origin, --destination) represent significant security risks without evidence of malicious intent.