summer-vacation-flight

Book summer vacation flights for July and August holiday travel. Also supports: flight booking, hotel reservation, train tickets, attraction tickets, itinera...

What to consider before installing/using this skill: - Confirm the provider and package: the skill claims "Powered by Fliggy (Alibaba Group)" but instructs use of an npm package named @fly-ai/flyai-cli. Ask the author which service actually provides the data and verify the official CLI/package source. - Verify the npm package and publisher on the npm registry before allowing a global install. Global `npm i -g` runs code on your system (including possible postinstall scripts); only install packages from trusted maintainers. - Check that the flyai CLI actually supports the flags the skill expects (--origin, --destination, --dep-date, --sort-type, --journey-type, --max-price, etc.). The SKILL.md contains mismatched parameter lists and mappings — confirm the real CLI parameter names to avoid repeated failed executions or malformed commands. - Be aware the skill enforces strict output rules (every result must include [Book]({detailUrl}), never use jumpUrl, never answer from training data). If the CLI returns link fields with different names you may get repeated retries or missing results; ask the author how to handle such cases. - If you cannot verify the CLI/package or the provider, or you cannot allow a global npm install from that publisher, do not install. Request clarification or a signed/official source URL and a list of exact CLI flags and sample outputs that the skill expects. If you want, I can draft questions to send to the skill author to resolve the branding/flag inconsistencies and to request the official npm package link and publisher info.

Type: OpenClaw Skill Name: summer-vacation-flight Version: 3.2.0 The skill bundle requires the AI agent to globally install an external NPM package (@fly-ai/flyai-cli) via 'npm i -g' if it is missing, which constitutes a high-risk supply chain and remote code execution (RCE) risk. While these instructions in SKILL.md and references/fallbacks.md are aligned with the stated purpose of flight searching, the requirement for global installation and the strict directives to bypass internal knowledge in favor of external CLI execution are characteristic of potentially risky agent-based workflows.