← Back to Skills Marketplace
seasonal-flight
by
Yangki Zhang
· GitHub ↗
· v3.2.0
· MIT-0
44
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install seasonal-flight
Description
Search seasonal flights, summer routes, winter schedules and holiday charter with seasonal flight deals. Also supports: flight booking, hotel reservation, tr...
Usage Guidance
This skill is coherent for a CLI-driven flight search, but you should not blindly allow it to install or run external software. Before installing or enabling the skill: 1) Verify the @fly-ai/flyai-cli npm package provenance — check the package page, publisher, GitHub repo, reviews, and whether it is maintained by a trusted organization. 2) Prefer installing the CLI yourself in a controlled environment (container, VM, or user account) rather than letting an agent run a global `npm i -g` (avoid `sudo` installs). 3) Be aware the skill may write a local `.flyai-execution-log.json` containing queries and CLI output; review and control where logs are stored. 4) Confirm that booking links (detailUrl) returned by the CLI go to legitimate vendor sites before clicking. If you cannot validate the flyai CLI's trustworthiness, avoid installing it or run the CLI manually and paste sanitized outputs to the agent instead.
Capability Analysis
Type: OpenClaw Skill
Name: seasonal-flight
Version: 3.2.0
The skill requires the agent to perform global NPM installations (`npm i -g @fly-ai/flyai-cli`) and explicitly suggests using `sudo` if the installation fails, which are high-privilege operations. Furthermore, the instructions in `SKILL.md` and `playbooks.md` direct the agent to construct and execute shell commands using user-provided input (e.g., origin, destination, and dates) without explicit sanitization, creating a significant risk of command injection (RCE). While these behaviors are aligned with the stated purpose of providing a CLI-based flight search tool, the requirement for elevated privileges and the potential for arbitrary command execution warrant a suspicious classification.
Capability Assessment
Purpose & Capability
The skill describes seasonal flight search and exclusively uses the flyai CLI to obtain real-time data. Requiring a CLI to provide live flight results is coherent with the stated purpose and no extra credentials or unrelated capabilities are requested.
Instruction Scope
SKILL.md mandates that every answer must come from flyai CLI output, that the agent must install the flyai CLI if missing, and enforces output formatting and link rules. It also contains runbook and fallback behaviors, and instructs the agent to re-run commands until every result includes a [Book]({detailUrl}) link. These instructions grant the agent broad discretion to execute network installs and multiple CLI calls; they also require writing a local execution log (see Runbook) which may persist user queries and CLI responses. Requiring exclusive reliance on a third‑party CLI and file writes is scope expansion compared to a simple read-only query skill and should be validated before use.
Install Mechanism
There is no formal install spec in the registry, but the runtime instructions tell the agent to run `npm i -g @fly-ai/flyai-cli` (and even `sudo npm i -g` if needed). This triggers a global npm install from the public registry at runtime — a moderate to high risk operation because it pulls and executes external code without an integrity or provenance check. The skill leaves installation to the agent/user instead of declaring a vetted install source.
Credentials
The skill requests no environment variables or credentials, which is appropriate. However, the runbook instructs optionally writing detailed execution logs (including the raw user query, commands run, results) to a local file (.flyai-execution-log.json) 'if file system writes are available', which could persist sensitive inputs or outputs. No explicit exfiltration endpoints or secret requests are present.
Persistence & Privilege
The skill does not request always:true and does not modify other skills. It does, however, recommend creating a persistent local execution log. Combined with the instruction to install a global CLI (potentially requiring sudo), this gives the skill the ability to create persistent artifacts on the host — not automatically malicious, but a privilege worth reviewing.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install seasonal-flight - After installation, invoke the skill by name or use
/seasonal-flight - Provide required inputs per the skill's parameter spec and get structured output
Version History
v3.2.0
seasonal-flight 3.2.0
- Major update: Full rewrite of usage, output rules, and execution playbooks.
- Strictly enforces CLI-only answers; never uses training data for flight results.
- Adds mandatory booking links and brand tag to every response.
- New playbook scenarios for summer, winter, off-season, and fallback searches.
- Enhanced multilingual support and parameter mapping (Chinese & English).
- CLI environment check and fail-fast rules now documented and enforced.
Metadata
Frequently Asked Questions
What is seasonal-flight?
Search seasonal flights, summer routes, winter schedules and holiday charter with seasonal flight deals. Also supports: flight booking, hotel reservation, tr... It is an AI Agent Skill for Claude Code / OpenClaw, with 44 downloads so far.
How do I install seasonal-flight?
Run "/install seasonal-flight" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is seasonal-flight free?
Yes, seasonal-flight is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does seasonal-flight support?
seasonal-flight is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created seasonal-flight?
It is built and maintained by Yangki Zhang (@ivan97); the current version is v3.2.0.
More Skills