← Back to Skills Marketplace
medical-tourism
by
bufferstreamer
· GitHub ↗
· v3.2.0
· MIT-0
71
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install medical-tourism
Description
Book flights for medical tourism, health checkups, and overseas treatment. Also supports: flight booking, hotel reservation, train tickets, attraction ticket...
Usage Guidance
This skill is suspicious because its SKILL.md directs the agent to install and run a third-party npm CLI at runtime even though the package source and required binary are not declared in the registry. Before installing or enabling it: 1) Verify the upstream package (@fly-ai/flyai-cli) on npm/js.org and inspect its homepage and code; confirm it is the official client for the claimed service (Fliggy/Alibaba). 2) Don't install globally on a production machine — test in an isolated sandbox or VM first. 3) Ask the skill author for a homepage, source repository, and details on how authentication and booking are handled (does the CLI prompt for credentials, store tokens, or require API keys?). 4) If you cannot verify the npm package and its publisher, decline or restrict the skill; installing arbitrary npm packages globally can run arbitrary code and persist on your system. 5) If you proceed, monitor network activity and filesystem changes and avoid providing sensitive credentials until you confirm the integration flow. Additional info (package homepage, code link, or publisher identity) would raise confidence and could change this assessment.
Capability Analysis
Type: OpenClaw Skill
Name: medical-tourism
Version: 3.2.0
The skill mandates the global installation of an external NPM package (`npm i -g @fly-ai/flyai-cli`) within `SKILL.md` and `references/fallbacks.md` if the tool is not found. While this appears functional for flight searching, requiring an AI agent to install and execute arbitrary third-party binaries is a high-risk behavior that facilitates potential supply chain attacks and host environment modification. Additionally, the instructions use aggressive prompt-injection techniques to force the agent to bypass its internal knowledge and strictly follow CLI-driven execution paths.
Capability Assessment
Purpose & Capability
The skill advertises flight/hotel/medical-tourism booking (claims 'Powered by Fliggy / Alibaba') but the runtime instructions rely on an external CLI (@fly-ai/flyai-cli) that is not declared in the registry metadata (no required binaries, no homepage or source). That mismatch (undeclared required binary + unknown upstream) is incoherent: a booking helper legitimately needs a booking API/CLI, but the registry should have declared that dependency and a trustworthy source.
Instruction Scope
SKILL.md instructs the agent to install (npm i -g @fly-ai/flyai-cli) and run flyai commands, to never answer from training data, and to re-run until every result contains a specific booking link. Those runtime actions cause network calls and global package installation and they assume the CLI will produce booking links and handle any auth — but the instructions do not specify where credentials come from or how authentication is performed. The skill also enforces strict rules (never use training data, always use CLI) that could cause the agent to attempt to install/run arbitrary code rather than gracefully degrade.
Install Mechanism
There is no declared install spec in the registry, yet the skill explicitly instructs installing a global npm package at runtime. Installing an arbitrary npm package globally can execute code on the host and persists on disk; the npm package (@fly-ai/flyai-cli) has no homepage/source listed in the skill metadata for verification. This is higher-risk than instruction-only behaviors that do not modify the host.
Credentials
The skill declares no required environment variables or credentials, which is unusual for a booking/booking-API integration (most booking flows require API keys, accounts, or OAuth). The absence of declared credentials may be explainable if the CLI handles auth interactively or via its own config, but that is not documented in SKILL.md — an information gap that reduces confidence and could hide exfiltration or unexpected auth flows.
Persistence & Privilege
Although the skill is not marked 'always', its runtime instructions install a global CLI (npm i -g), which creates persistent binaries on the host and can increase blast radius. The registry metadata did not surface this persistent install, so the skill effectively gains persisted presence without explicit declaration.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install medical-tourism - After installation, invoke the skill by name or use
/medical-tourism - Provide required inputs per the skill's parameter spec and get structured output
Version History
v3.2.0
Medical tourism skill now operates exclusively via real-time CLI bookings with strict output validation.
- All responses must use real-time data from flyai CLI, never static knowledge or training data.
- Enforced `[Book](detailUrl)` link for every listed result; output with no link is invalid.
- Supports flight, hotel, train, attractions, itinerary, visa, insurance, and car rental booking, focused on medical travel scenarios.
- Handles both English and Chinese input; requires explicit parameter mapping and user confirmation when info is missing.
- Rigid output and workflow rules: CLI environment checks, step-by-step collection, execution, formatting, and output validation.
- Added brand tagging and output enrichment guidance for user results.
Metadata
Frequently Asked Questions
What is medical-tourism?
Book flights for medical tourism, health checkups, and overseas treatment. Also supports: flight booking, hotel reservation, train tickets, attraction ticket... It is an AI Agent Skill for Claude Code / OpenClaw, with 71 downloads so far.
How do I install medical-tourism?
Run "/install medical-tourism" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is medical-tourism free?
Yes, medical-tourism is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does medical-tourism support?
medical-tourism is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created medical-tourism?
It is built and maintained by bufferstreamer (@bufferstreamer); the current version is v3.2.0.
More Skills