← Back to Skills Marketplace
499
Downloads
0
Stars
1
Active Installs
1
Versions
Install in OpenClaw
/install duffel
Description
Search, book, and manage flights via the Duffel Flights API. Covers 300+ airlines (NDC, GDS, LCC). Use when: (1) searching for flights between cities, (2) co...
README (SKILL.md)
Duffel Flights
Search, book, and manage flights across 300+ airlines via the Duffel API.
Setup
Set DUFFEL_TOKEN env var with your Duffel API access token.
Get one at https://app.duffel.com → Developers → Access Tokens.
Test tokens (prefix duffel_test_) use sandbox data with unlimited balance.
Commands
Search flights
python scripts/duffel.py search --from MIA --to LHR --date 2026-04-15
python scripts/duffel.py search --from MIA --to CDG --date 2026-03-15 --return-date 2026-03-22 --cabin business
python scripts/duffel.py search --from JFK --to LAX --date 2026-05-01 --nonstop --adults 2
Options: --cabin economy|premium_economy|business|first, --nonstop, --adults N, --children N, --infants N, --sort price|duration, --max-results N, --json
Results are numbered. Use the number with other commands.
View offer details
python scripts/duffel.py offer 3
Shows segments, baggage, fare conditions (refund/change), available extras.
Book a flight
python scripts/duffel.py book 3 --pax "RIBEIRO/FABIO MR 1977-01-31 [email protected] +13059159687 BR m"
Pax format: LAST/FIRST TITLE DOB EMAIL PHONE NATIONALITY GENDER
- TITLE: MR, MRS, MS, MISS, DR
- GENDER: m or f
- Multiple passengers: repeat
--pax "..."for each
Payment uses Duffel account balance. Top up at https://app.duffel.com.
Check order status
python scripts/duffel.py order ord_0000XXXXX
Cancel order
python scripts/duffel.py cancel ord_0000XXXXX # Quote (shows refund amount)
python scripts/duffel.py cancel ord_0000XXXXX --confirm # Execute cancellation
Seat map
python scripts/duffel.py seatmap 3
Airport/city lookup
python scripts/duffel.py places "new york"
Typical workflow
search→ browse numbered resultsoffer N→ check details, baggage, conditionsbook N --pax "..."→ get PNRorder \x3Cid>→ verify bookingcancel \x3Cid>→ if needed
Notes
- Offers expire (usually ~20 min). Re-search if expired.
- Test mode: unlimited balance, bookings on "Duffel Airways" (fake airline).
- Production: real airlines, real tickets. Balance must be funded.
- All commands support
--jsonfor raw API output. - Last search saved to
/tmp/duffel-last-search.jsonfor index reference. - For API details, see
references/api-guide.mdandreferences/booking-flow.md.
Usage Guidance
This skill appears to be a legitimate Duffel API CLI, but the package metadata omits the required DUFFEL_TOKEN and the repository lists a dependency (requests) without an install step. Before installing: (1) Prefer using a Duffel test token (duffel_test_...) so you only hit the sandbox; (2) Do NOT provide a live DUFFEL_TOKEN unless you fully trust the skill source — a live token can create real bookings and incur charges; (3) Review scripts/duffel.py (it sets Authorization: Bearer <token>, writes /tmp/duffel-last-search.json, and sends passenger data to the Duffel API); (4) Ensure the environment has the requests library or install it in an isolated environment; (5) Consider limiting autonomous agent invocation or disabling model-driven actions until you've tested with a sandbox token; (6) If you proceed with a production token, rotate it afterward and monitor your Duffel account activity.
Capability Analysis
Type: OpenClaw Skill
Name: duffel
Version: 1.0.0
The skill bundle is benign. It provides a CLI interface to the Duffel Flights API, using standard Python libraries (`requests`, `argparse`) for its functionality. It reads the `DUFFEL_TOKEN` from environment variables for authentication and makes network requests exclusively to `https://api.duffel.com`. Temporary files for caching search results and cancellation quotes are written to `/tmp`, which is a common practice for transient data and does not contain sensitive information like credentials. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, obfuscation, or prompt injection attempts against the OpenClaw agent in `SKILL.md`.
Capability Assessment
Purpose & Capability
The code and SKILL.md implement searching, offers, booking, order/cancel, seat maps and places lookups against https://api.duffel.com — this is coherent with the skill name/description. However, the registry metadata claims no required environment variables while both SKILL.md and scripts/duffel.py require a DUFFEL_TOKEN. That mismatch is an incoherence in the package manifest (the skill legitimately needs the token, but the metadata does not declare it).
Instruction Scope
Runtime instructions and the script stay within the claimed scope: they call Duffel API endpoints, save the last search to /tmp/duffel-last-search.json, and do not reference unrelated system paths or other credentials. Note: booking operations will transmit passenger personal data (names, DOB, email, phone, nationality) to Duffel — this is expected for a booking tool but is sensitive and should be handled with care.
Install Mechanism
There is no install spec (instruction-only install), which is low-risk. The repository includes scripts/requirements.txt listing 'requests' but no automated install step is declared; that's an inconsistency (the code depends on requests but the package metadata does not list it). No downloads from external/untrusted URLs are present.
Credentials
The only runtime credential required is DUFFEL_TOKEN, which is appropriate for this skill. However the package metadata declares no required env variables or primary credential while the code and SKILL.md require DUFFEL_TOKEN — this is an important mismatch. Because DUFFEL_TOKEN can be a production token able to create real bookings and charge the linked account/wallet, the missing declaration reduces transparency and increases risk if you supply a live token without realizing it.
Persistence & Privilege
The skill does not request always:true and does not modify other skills or system-wide settings. It writes a single file to /tmp/duffel-last-search.json to store last search results. Note: the skill can be invoked autonomously by the agent (default platform behavior); if given a live DUFFEL_TOKEN, an agent could perform searches and bookings on your behalf, so confirm agent invocation permissions before granting credentials.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install duffel - After installation, invoke the skill by name or use
/duffel - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
- Initial release of the Duffel skill for searching, booking, and managing flights via the Duffel Flights API.
- Supports over 300 airlines (NDC, GDS, LCC) with features including flight search, offer comparison, booking, order status, cancellation, seat maps, and airport/city code lookup.
- Allows filtering by cabin class, nonstop preference, passenger count, and trip type (one-way or round-trip).
- Includes commands for viewing fare details and managing cancellations with refund quotes.
- Provides sandbox mode for testing and production mode for real bookings.
Metadata
Frequently Asked Questions
What is Duffel Flights?
Search, book, and manage flights via the Duffel Flights API. Covers 300+ airlines (NDC, GDS, LCC). Use when: (1) searching for flights between cities, (2) co... It is an AI Agent Skill for Claude Code / OpenClaw, with 499 downloads so far.
How do I install Duffel Flights?
Run "/install duffel" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Duffel Flights free?
Yes, Duffel Flights is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Duffel Flights support?
Duffel Flights is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Duffel Flights?
It is built and maintained by fabiolr (@fabiolr); the current version is v1.0.0.
More Skills