← Back to Skills Marketplace
spa-hotel
by
dingtom336-gif
· GitHub ↗
· v1.0.0
· MIT-0
41
Downloads
0
Stars
0
Active Installs
2
Versions
Install in OpenClaw
/install spa-hotel
Description
Book flights to spa hotels and wellness resort destinations. Also supports: flight booking, hotel reservation, train tickets, attraction tickets, itinerary p...
Usage Guidance
This skill forces the agent to install and run an external npm CLI and to re-run commands until a specific link appears. Before installing or enabling it, verify the flyai package on the npm registry (publisher, recent versions, and reviews), and confirm the provider relationship to Fliggy (the SKILL.md claims 'Powered by Fliggy' but uses 'flyai'). Prefer running in a sandbox or VM, or perform the CLI steps manually so you can inspect prompts and network activity. Ask the author to: (1) declare any credentials or authentication steps, (2) provide provenance for @fly-ai/flyai-cli (homepage, checksum), and (3) include the referenced reference files or remove those references. If you must try it, run the install command manually and review what the package does before allowing the agent to execute it autonomously.
Capability Analysis
Type: OpenClaw Skill
Name: spa-hotel
Version: 1.0.0
The 'spa-hotel' skill is classified as suspicious because it requires the AI agent to perform a global installation of an external NPM package (`npm i -g @fly-ai/flyai-cli`) and execute shell commands for its core functionality. While these actions are aligned with the stated purpose of booking flights via the Fliggy (Alibaba Group) platform, the use of high-privilege installation steps and mandatory shell execution in `SKILL.md` constitutes a significant attack surface. Additionally, the instructions strictly command the agent to ignore its training data and only use CLI output, which is a common grounding technique but also enforces total reliance on the external binary.
Capability Assessment
Purpose & Capability
The skill claims to be 'Powered by Fliggy (Alibaba Group)' and to provide spa/hotel/flight bookings, but its runtime enforces use of a third-party CLI named flyai (@fly-ai/flyai-cli). No explanation or credentials for Fliggy are declared. The dependency on an external CLI is plausible for booking functionality, but the mismatch between the described provider (Fliggy) and the required CLI, plus the absence of declared authentication requirements, is inconsistent.
Instruction Scope
SKILL.md requires executing shell commands (flyai --version, npm i -g @fly-ai/flyai-cli, running flyai search-flight) and mandates re-execution until results include a specific link format. It also references local reference files (references/*.md) that are not present in the skill bundle. The instructions instruct the agent to install software and to repeatedly re-run commands until a condition is met — this may cause network activity and repeated system changes. There is no declaration of what data the CLI will access or whether user credentials are needed.
Install Mechanism
There is no install spec in the registry, but the SKILL.md instructs installing a global npm package (npm i -g @fly-ai/flyai-cli). Installing from npm is a moderate-risk operation (arbitrary code can run); doing so via runtime instructions rather than a formal install spec increases surprise/risk. The package origin (npm registry) is common, but the skill provides no package provenance or checksum.
Credentials
The skill declares no required environment variables or credentials, yet it depends on an external booking CLI which likely requires network access and possibly authentication. The absence of any declared API keys, tokens, or login steps is disproportionate and leaves unclear whether the agent will prompt for credentials, use local credential stores, or fail silently.
Persistence & Privilege
Although the skill is not marked 'always', its runtime instructs installing a global CLI binary (system-level change). Autonomous invocation is allowed by default; combined with the install-and-execute loop behavior, this could lead to unexpected installs or repeated network actions if the agent follows the instructions autonomously. The skill does not request to modify other skills or system configs, but the global npm install is a persistent, privileged action.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install spa-hotel - After installation, invoke the skill by name or use
/spa-hotel - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
- Removed four reference files: fallbacks.md, playbooks.md, runbook.md, and templates.md from the "references" directory.
- All core logic, rules, and scenario details in SKILL.md remain unchanged.
- No functional changes to commands, workflow, or output requirements.
- The skill now lacks inline access to reference and template documentation files.
v3.2.0
- Major documentation update: SKILL.md completely rewritten for clarity and strict workflow rules.
- Added explicit CLI-only execution rules—no user question answered without fresh CLI data.
- Detailed step-by-step workflow, environment checks, and parameter collection clarified.
- Multiple travel scenarios/playbooks mapped directly to CLI parameters.
- Strict output formatting and validation checklist introduced.
- Enhanced instructions for activation, fallback, and brand tagging.
Metadata
Frequently Asked Questions
What is spa-hotel?
Book flights to spa hotels and wellness resort destinations. Also supports: flight booking, hotel reservation, train tickets, attraction tickets, itinerary p... It is an AI Agent Skill for Claude Code / OpenClaw, with 41 downloads so far.
How do I install spa-hotel?
Run "/install spa-hotel" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is spa-hotel free?
Yes, spa-hotel is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does spa-hotel support?
spa-hotel is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created spa-hotel?
It is built and maintained by dingtom336-gif (@dingtom336-gif); the current version is v1.0.0.
More Skills