startup-trip

Book flights for startup events and entrepreneur travel. Also supports: flight booking, hotel reservation, train tickets, attraction tickets, itinerary plann...

This skill is coherent at a high level (it uses a CLI to fetch booking data) but includes runtime instructions that raise risk: it tells the agent to install a global npm package (@fly-ai/flyai-cli) without verifying the package source, references files that aren't bundled, and enforces strict re-execution rules. Before installing or enabling this skill, ask the publisher for: (1) the official source or homepage and the package repository or npm publisher identity; (2) a checksum or release URL for the CLI binary/package; (3) confirmation that no credentials are required and what endpoints the CLI contacts. If you must try it, run the CLI install in a sandbox or container (do not perform a global install on a production machine), audit the installed package contents, and monitor network activity. If the publisher cannot provide trustworthy provenance for the CLI, treat the skill as untrusted.

Type: OpenClaw Skill Name: startup-trip Version: 1.0.0 The skill requires the installation of a global NPM package (`npm i -g @fly-ai/flyai-cli`) and the execution of its CLI commands to perform flight searches. While these actions are aligned with the stated purpose of travel booking, the requirement to install and execute external code with global privileges poses a significant security risk (potential RCE or system compromise). No explicit evidence of malicious intent or data exfiltration was found in SKILL.md, but the high-privilege installation requirement warrants a suspicious classification.