← Back to Skills Marketplace
120
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install otto-travel-local
Description
OpenClaw plugin for Otto Travel — search, compare, and book flights and hotels via Otto's MCP endpoint.
Usage Guidance
This plugin appears to do what it says: it connects to the configured Otto MCP endpoint, runs an OAuth device flow, stores tokens at ~/.openclaw/.otto-tokens.json (0600), and dynamically registers tools. Before installing: (1) Confirm you trust the MCP server URL (default https://api.ottotheagent.com/mcp) — changing it to an untrusted host would let the plugin contact that host and store credentials for it; (2) review the repository/source (package.json points to a GitHub repo) if you want provenance assurance; (3) be aware the plugin depends on the @modelcontextprotocol/sdk and its npm deps (normal for MCP clients); (4) the bundle includes TypeScript source (index.ts) and expects the OpenClaw runtime to load/compile TS — verify your runtime supports this. If any of these are unclear or you don't trust the server URL, do not install.
Capability Analysis
Type: OpenClaw Skill
Name: otto-travel-local
Version: 1.0.0
The plugin is a standard implementation of a Model Context Protocol (MCP) client for travel services (Otto Travel). It uses a legitimate OAuth 2.1 Device Authorization Grant flow for authentication and follows security best practices by storing access tokens locally with restricted file permissions (0600) in `~/.openclaw/.otto-tokens.json`. The code logic in `index.ts`, `src/auth.ts`, and `src/mcp-client.ts` is transparent, aligns with the stated purpose, and contains no evidence of data exfiltration, malicious execution, or prompt injection.
Capability Assessment
Purpose & Capability
Name and description (Otto Travel MCP client) match the code and runtime behavior: the plugin discovers tools from an MCP server, registers them, and calls them. Declared defaults (serverUrl) and the use of @modelcontextprotocol/sdk are coherent with the stated purpose.
Instruction Scope
SKILL.md describes installing the plugin locally and configuring serverUrl. Runtime instructions and code implement an OAuth Device Authorization flow, tool discovery, and tool invocation. The instructions and code only access the MCP server and a local token file; they do not read arbitrary user files, environment variables, or send data to unexpected external endpoints.
Install Mechanism
The registry metadata said 'No install spec — instruction-only', but the package includes source files, package.json, and package-lock.json and the README/SKILL.md instruct installing the plugin locally via openclaw plugins install ./openclaw-otto-travel. There is no network download/install step in the manifest itself. The dependency on @modelcontextprotocol/sdk (and its npm deps) is expected for MCP connectivity; no suspicious remote archives or shorteners are used.
Credentials
The skill requests no environment variables or external credentials in metadata; it implements OAuth device flow and stores tokens to ~/.openclaw/.otto-tokens.json with 0600 permissions. The requested/local persistence of OAuth tokens is proportionate to the plugin's purpose. No unrelated secrets or config paths are requested or accessed.
Persistence & Privilege
always is false and model invocation is allowed (platform default). The plugin persists only its own token file under the user's home directory and does not modify other skills or system-wide settings. This level of persistence is normal for an OAuth-based plugin.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install otto-travel-local - After installation, invoke the skill by name or use
/otto-travel-local - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial local install
Metadata
Frequently Asked Questions
What is Otto Travel Local?
OpenClaw plugin for Otto Travel — search, compare, and book flights and hotels via Otto's MCP endpoint. It is an AI Agent Skill for Claude Code / OpenClaw, with 120 downloads so far.
How do I install Otto Travel Local?
Run "/install otto-travel-local" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Otto Travel Local free?
Yes, Otto Travel Local is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Otto Travel Local support?
Otto Travel Local is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Otto Travel Local?
It is built and maintained by cd-otto (@cd-otto); the current version is v1.0.0.
More Skills