one-way

Search one-way flights, single-trip tickets and open-ended travel bookings with no return date required. Also supports: flight booking, hotel reservation, tr...

This skill appears to do what it says (use a CLI to search one-way flights), but there are a few practical risks to consider before installing or allowing it to run automatically: - The SKILL.md tells the agent to run 'npm i -g @fly-ai/flyai-cli' if the flyai CLI is missing. A global npm install downloads code from the public registry and may require elevated privileges. Prefer to install such packages yourself after verifying the publisher (check the npm page, README, and package owner) rather than letting an automated agent run the command. - The skill's description mentions Fliggy but the runtime uses 'flyai'; this mismatch is unexplained. Verify the provenance: where does flyai come from and who operates it? - The runbook instructs writing an execution log (.flyai-execution-log.json) containing raw user queries and CLI output. If your queries include personal data (names, itinerary details, passport info), those will be persisted on disk. Decide whether you want local logs and where they will be stored. - The skill enforces strict output formatting and a re-execution 'self-test' which could cause repeated CLI calls and network traffic if outputs do not match expected patterns. Recommended actions before use: 1. Manually verify the @fly-ai/flyai-cli package on npm (owner, downloads, homepage, repository, recent activity). Do not blindly allow the agent to perform a global npm install. 2. If you allow installation, prefer local sandboxed environments or a user-level install rather than system-wide global install. 3. Decide whether persistent logs are acceptable; if not, prevent or sanitize the skill's ability to write files. 4. If you need stronger assurance, ask the skill author for an authoritative homepage, source repo, or signed release for the flyai CLI. Given these unexplained behaviors (external install instruction, local logging, metadata mismatch), treat the skill as suspicious until provenance and install practices are confirmed.

Type: OpenClaw Skill Name: one-way Version: 3.2.0 The skill bundle mandates the global installation of an external NPM package (`npm i -g @fly-ai/flyai-cli`) if the command is missing, which is a high-privilege operation and a potential supply chain risk (SKILL.md, fallbacks.md). While the instructions are functionally aligned with searching flights via Fliggy, the 'CRITICAL EXECUTION RULES' strictly force the agent to execute these CLI commands and ignore its internal knowledge, ensuring the external code is run. No evidence of intentional malice was found, but the requirement for global software installation warrants caution.