← Back to Skills Marketplace
marathon-trip
by
bufferstreamer
· GitHub ↗
· v3.2.0
· MIT-0
70
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install marathon-trip
Description
Book flights for marathon and running event trips. Also supports: flight booking, hotel reservation, train tickets, attraction tickets, itinerary planning, v...
Usage Guidance
This skill appears to be a CLI-driven flight-booking helper that expects to call a third-party tool (flyai). Before installing or enabling it: 1) Verify the provenance of the @fly-ai/flyai-cli npm package (check npmjs.org, read package source, maintainer, and recent releases); 2) Confirm the claimed provider — the SKILL.md mentions Fliggy (Alibaba) but the CLI is named 'flyai' (this mismatch could be harmless or indicate an impersonation); 3) Be cautious about running 'npm i -g' globally — consider testing in a sandbox or container, since npm packages can run code at install and runtime; 4) If you require guarantees, ask the skill author for a homepage, code repository, or signed release; 5) If you decide to proceed, monitor the network requests and package behavior (and avoid giving unrelated credentials). If the author cannot clarify the Node/npm dependency or provider relationship, treat the skill as untrusted.
Capability Analysis
Type: OpenClaw Skill
Name: marathon-trip
Version: 3.2.0
The skill requires the global installation of an external NPM package (@fly-ai/flyai-cli) and executes shell commands with parameters derived from user input (SKILL.md). While these actions are aligned with the stated purpose of flight booking, the requirement for global installation and the potential for shell injection via unsanitized parameters represent significant security risks. No evidence of intentional malice or data exfiltration was found.
Capability Assessment
Purpose & Capability
The skill claims to book flights/hotels/etc. and its runtime instructions rely entirely on a third-party CLI (flyai). However the skill manifest declares no required binaries or credentials while the instructions require Node/npm and a global npm package (@fly-ai/flyai-cli). This mismatch (manifest says 'none' but SKILL.md instructs installing tooling) is an incoherence that should be resolved. Also the description says 'powered by Fliggy (Alibaba Group)' while the CLI is named 'flyai'—the provider relationship is unclear.
Instruction Scope
The SKILL.md stays within the travel-booking domain: it mandates using the flyai CLI, defines exact commands and parameters, forbids using training data, and requires results to include booking links. It does not instruct reading unrelated files, accessing arbitrary environment variables, or exfiltrating data. The strict 'must use CLI' rules limit scope, but the self-test and re-execution loop give the agent broad autonomy to repeatedly call the CLI.
Install Mechanism
There is no registry install spec, but SKILL.md directly tells the agent to run 'npm i -g @fly-ai/flyai-cli' when flyai isn't present. Installing a global npm package on the fly is a moderate risk: npm packages can execute arbitrary code at install/run time. The skill does not declare this install action in its manifest and provides no canonical source, homepage, or checksum for verification.
Credentials
The skill requests no environment variables, credentials, or config paths in the registry metadata. The actual instructions likewise do not request access to secrets or unrelated credentials. This access level is proportionate to the stated purpose.
Persistence & Privilege
always is false and the skill is user-invocable with normal autonomous invocation allowed. The skill does not ask to modify other skills or system settings. The main persistence concern is the optional global npm install (which would write to system/global npm modules), but that is not an automatic registry install flag—it's an instruction the agent may follow.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install marathon-trip - After installation, invoke the skill by name or use
/marathon-trip - Provide required inputs per the skill's parameter spec and get structured output
Version History
v3.2.0
marathon-trip 3.2.0
- Expanded booking support: Now includes hotel reservation, train tickets, attraction tickets, itinerary planning, visa info, travel insurance, and car rental alongside flights.
- Detailed CLI execution and output validation instructions to ensure all information comes from real-time flyai results.
- New and improved parameter mapping and scenario playbooks for handling various marathon and race day travel queries.
- Enhanced output rules: Conclusion-first answers, comparison tables, and consistent booking links.
- Compatibility expanded to more agents and platforms.
Metadata
Frequently Asked Questions
What is marathon-trip?
Book flights for marathon and running event trips. Also supports: flight booking, hotel reservation, train tickets, attraction tickets, itinerary planning, v... It is an AI Agent Skill for Claude Code / OpenClaw, with 70 downloads so far.
How do I install marathon-trip?
Run "/install marathon-trip" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is marathon-trip free?
Yes, marathon-trip is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does marathon-trip support?
marathon-trip is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created marathon-trip?
It is built and maintained by bufferstreamer (@bufferstreamer); the current version is v3.2.0.
More Skills