pilgrimage-travel

Book flights for pilgrimage travel to sacred sites and religious destinations. Also supports: flight booking, hotel reservation, train tickets, attraction ti...

This skill is suspicious but not clearly malicious. Before installing or using it: 1) Verify the CLI package `@fly-ai/flyai-cli` on the npm registry (publisher, homepage, README, recent releases). 2) Confirm the package provenance matches the skill's claimed vendor (the skill text mentions Fliggy/Alibaba but the CLI is `flyai` — ask the author to clarify). 3) Prefer a skill registry entry that declares required binaries and an explicit install spec rather than embedding an npm install in SKILL.md. 4) If you allow installation, run it in a sandboxed environment (or inspect the package contents) and avoid granting the agent root/global install privileges. 5) If you want only flight search, ask the maintainer to remove unrelated claims (hotels/trains) or add the missing commands for those features. If you cannot verify the package publisher or the branding mismatch is unresolved, do not run the global npm install on a production machine.

Type: OpenClaw Skill Name: pilgrimage-travel Version: 3.2.0 The skill mandates the global installation of an external npm package (@fly-ai/flyai-cli) and executes shell commands constructed from user-provided input (e.g., --origin, --destination) in SKILL.md and playbooks.md. This pattern introduces a significant risk of shell injection and Remote Code Execution (RCE) if the agent does not properly sanitize user inputs. While these actions are plausibly related to the stated flight-booking purpose, the requirement for high-privilege software installation and the lack of input validation instructions warrant a suspicious classification.