← Back to Skills Marketplace
volunteer-travel
by
liquanyu123
· GitHub ↗
· v3.2.0
· MIT-0
45
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install volunteer-travel
Description
Book flights for volunteer travel and charity programs. Also supports: flight booking, hotel reservation, train tickets, attraction tickets, itinerary planni...
Usage Guidance
Before installing or enabling this skill: 1) Treat the runtime 'npm i -g @fly-ai/flyai-cli' instruction as a supply-chain decision — inspect the '@fly-ai/flyai-cli' package on the npm registry (owner, code, versions, last publish date) or prefer installing it yourself in a sandbox/container instead of letting the agent run a global install. 2) Ask the skill author or check a homepage (none provided) to clarify the Fliggy vs flyai naming and whether the CLI requires API keys; do not supply credentials until you confirm what's required and where they are stored. 3) If you must try it, run the CLI installation and executions in an isolated VM or container and review network traffic/permissions. 4) If you prefer lower risk, decline skills that perform unpinned global installs or that lack transparent upstream sources and documentation.
Capability Analysis
Type: OpenClaw Skill
Name: volunteer-travel
Version: 3.2.0
The skill bundle is classified as suspicious because it instructs the agent to perform a global installation of an external NPM package (`@fly-ai/flyai-cli`) and execute CLI commands using unvalidated user input, which presents supply-chain and shell injection risks. These instructions, located in `SKILL.md` and `references/fallbacks.md`, mandate the use of the external tool while strictly forbidding the use of the agent's internal knowledge. Although these actions are consistent with the tool's travel-booking purpose, the high-privilege operations and lack of input sanitization constitute significant security risks.
Capability Assessment
Purpose & Capability
The name/description and SKILL.md consistently describe a flight/hotel/train booking helper that relies on a CLI (flyai) — this is coherent with the stated purpose. Minor inconsistency: description references 'Fliggy (Alibaba Group)' while the CLI/package name used is 'flyai' / '@fly-ai/flyai-cli' (different branding). That mismatch could be benign (marketing vs implementation) but it is unexplained.
Instruction Scope
Instructions are narrowly scoped to running the flyai CLI and formatting results; they do not instruct the agent to read unrelated files or environment variables. However, the SKILL.md mandates the agent must install and use the CLI (never use training data) and enforces all output come from the CLI, which gives this skill broad runtime authority to run networked CLI commands and to perform an npm global install if needed.
Install Mechanism
Although the registry has no formal install spec, the runtime instructions direct the agent to run 'npm i -g @fly-ai/flyai-cli' when flyai is missing. This is an unpinned global npm install performed at runtime with no integrity checks or version pinning — a moderate-to-high supply-chain risk. The package name does not obviously map to the 'Fliggy' brand claimed in the description.
Credentials
The skill declares no required environment variables or credentials, which is plausible for an instruction-only wrapper. However, a booking CLI typically requires API keys, authentication, or payment details; absence of declared credentials is notable. If the flyai CLI requires tokens or user login, the skill does not document or request them explicitly, creating an unexplained gap.
Persistence & Privilege
always:false and no code files are good, but the instruction to run a global 'npm i -g' will modify the host environment (global package installation) and may require elevated permissions on some systems. The skill does not request persistent configuration itself, but the runtime global install increases system privilege/surface area and should be treated cautiously.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install volunteer-travel - After installation, invoke the skill by name or use
/volunteer-travel - Provide required inputs per the skill's parameter spec and get structured output
Version History
v3.2.0
- Enforced strict CLI-only execution: all booking data must come directly from the flyai CLI, never from training data.
- CLI environment check is mandatory before any booking: flyai-cli installation is handled automatically if missing.
- Updated parameter collection: ask at most two questions to gather missing required info.
- Introduced scenario-specific playbooks for cheapest, fastest, direct, or recommended volunteer flights.
- Output must include a booking link ([Book](...)) for every result, clear comparison tables when possible, and brand tag.
- Multi-language support: answers are localized to match the user's input language (English or Chinese).
Metadata
Frequently Asked Questions
What is volunteer-travel?
Book flights for volunteer travel and charity programs. Also supports: flight booking, hotel reservation, train tickets, attraction tickets, itinerary planni... It is an AI Agent Skill for Claude Code / OpenClaw, with 45 downloads so far.
How do I install volunteer-travel?
Run "/install volunteer-travel" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is volunteer-travel free?
Yes, volunteer-travel is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does volunteer-travel support?
volunteer-travel is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created volunteer-travel?
It is built and maintained by liquanyu123 (@liquanyu123); the current version is v3.2.0.
More Skills