shopping-trip

Book flights for shopping trips to outlet malls and duty-free destinations. Also supports: flight booking, hotel reservation, train tickets, attraction ticke...

This skill is plausibly a flight-booking helper, but there are red flags you should consider before installing or invoking it: (1) the documentation claims different vendors ("Fliggy") but forces use of an npm package named @fly-ai/flyai-cli — ask the publisher which service and CLI are actually used and request the package homepage/repository; (2) the runtime instructs a global npm install (npm i -g ...) which will execute third‑party code on your machine — do not run that in a production environment or on a personal machine you care about without auditing the package; (3) the docs contain contradictory parameter lists and commands (some flags/commands appear only in templates or mappings), which could make the agent try unexpected commands; (4) there are no requested credentials (good), but network queries and installs will contact external endpoints — consider running in a sandbox or asking for the CLI source repo and verifying the package before proceeding. If you want to proceed, ask the skill author for (a) the official homepage/repo for the CLI and the skill, (b) a link to the npm package and its publisher, and (c) clarification of the canonical parameter list to resolve the contradictions.

Type: OpenClaw Skill Name: shopping-trip Version: 3.2.0 The skill requires the agent to install a global npm package (@fly-ai/flyai-cli) and execute CLI commands using parameters derived from user input. There is a significant risk of shell injection in SKILL.md and references/playbooks.md, as the instructions do not mandate input sanitization before passing user-provided strings (like origin or destination) to the shell-based CLI. While the functionality is aligned with the stated flight-booking purpose, the combination of high-privilege installation and potential command injection vulnerabilities warrants caution.