travel-wallet

Search for budget-friendly flights with travel wallet planning. Also supports: flight booking, hotel reservation, train tickets, attraction tickets, itinerar...

This skill is inconsistent: it advertises many travel features (hotels, trains, Fliggy integration) but its instructions only call an external 'flyai' CLI for flight searches and instruct the agent to run `npm i -g @fly-ai/flyai-cli` if the CLI is missing. Installing a global, unpinned npm package from an unknown publisher can alter your system and is risky. Before installing or using this skill, do one or more of the following: 1) Verify the @fly-ai/flyai-cli package on npm/GitHub (owner, source code, recent activity, and trustworthiness); 2) Ask the skill author to explain/justify the Fliggy claim and provide documentation for hotel/booking flows (and whether any credentials will be required or captured); 3) Prefer a pinned package version and a non-global or sandboxed install; 4) Avoid installing on sensitive machines — test in an isolated environment; 5) If you need booking/payment features, require explicit details about how user credentials/payment data are handled. If the author cannot clarify these points, treat the skill as untrusted.

Type: OpenClaw Skill Name: travel-wallet Version: 3.2.0 The skill bundle instructs the AI agent to perform a global system modification by installing an external NPM package (`npm i -g @fly-ai/flyai-cli`) if the command is missing (found in `SKILL.md` and `references/fallbacks.md`). While this is presented as a prerequisite for the flight search functionality, executing global installations is a high-risk behavior that could facilitate supply chain attacks. No explicit evidence of data exfiltration or malicious intent was found, but the automated installation of unverified third-party software warrants a suspicious classification.