Variflight

Query flight information, train tickets, and travel data using Variflight (飞常准) HTTP API. Use when the user needs to (1) search flights by route or flight number, (2) check flight status and punctuality, (3) find train tickets, (4) get airport weather forecasts, (5) check flight prices, (6) plan multi-modal trips (flight+train), or (7) get flight comfort metrics (happiness index).

What to check before installing: - Confirm the API key requirement: the code and SKILL.md require VARIFLIGHT_API_KEY, but the registry metadata lists none. Ask the publisher to update registry metadata (declare VARIFLIGHT_API_KEY as the primary credential). - Verify the source: SKILL.md suggests cloning from https://github.com/variflight-ai/variflight-skill.git and talks to https://ai.variflight.com. Confirm that those domains/repositories are official and trustworthy before providing any API key. - Inspect config files referenced (~/.variflight.json, ~/.config/variflight/config.json, ~/.openclaw/workspace/.env.variflight) to ensure they don't contain unrelated secrets. Prefer storing the Variflight key in a minimal-scope secret (CI secret store or a purpose-built config file) rather than broad shell rc files. - Run the scripts in a restricted environment (sandbox/VM/container) if you need to test them, and monitor network calls to confirm they only contact the expected host (ai.variflight.com). - If you need stronger assurance, request the maintainer to: (1) publish a homepage/source link in registry metadata, (2) explicitly declare required environment variables in the registry, and (3) provide a reproducible package (checked release on GitHub) so you can verify integrity. Why I labelled this suspicious: The functionality and code are coherent with the described purpose, but the registry metadata omission of the required API key and the code's reading of user config paths create an unexplained mismatch that should be resolved before trusting the skill with secrets.

Type: OpenClaw Skill Name: variflight Version: 1.0.1 The OpenClaw AgentSkills skill bundle is benign. All shell scripts act as wrappers, safely passing arguments to the `variflight.py` Python script. The Python script correctly parses arguments, loads API keys from expected locations, and then securely serializes all user-provided parameters into a JSON body before making an HTTP POST request to a hardcoded, legitimate Variflight API endpoint (`https://ai.variflight.com/api/v1/mcp/data`) using `urllib.request`. There is no evidence of prompt injection in `SKILL.md` or `README.md`, no data exfiltration, no malicious execution (e.g., `eval`, `os.system`, `curl|bash`), and no attempts at persistence or obfuscation.