military-flights

Find military flight benefits, veteran discounts and armed forces travel deals with military fare tickets for service members. Also supports: flight booking,...

This skill is plausible for live military-fare lookups, but it has several red flags you should consider before installing or allowing autonomous runs: - Provenance missing: There is no homepage or source repo and the registry metadata does not declare the required 'flyai' CLI even though SKILL.md requires it. Verify the publisher identity and read the package repository (npm page / GitHub) before installing. - Implicit global install: The skill will attempt to run 'npm i -g @fly-ai/flyai-cli' if the CLI is absent. Global npm installs execute third-party code on your machine — prefer installing in a sandbox or review the package contents first. - Persistent local logs: The runbook suggests appending a JSON execution log (.flyai-execution-log.json) containing the raw user_query and steps. This may store PII/travel details. If you install, decide whether persistent logging is acceptable and where logs are written. - No declared binaries/install spec: The registry should list required binaries or an install spec. The omission is an incoherence; ask the publisher to provide a formal install manifest or signed release URLs. - Operational impact: If you allow the agent to auto-install packages, restrict it to a controlled environment or require manual confirmation. If you cannot validate the @fly-ai package, decline to install or run the skill. What would raise confidence to 'benign': a verifiable homepage or source repo, published package with a readable audit trail (repository, changelog, maintainer identity), a registry-declared required binary entry for 'flyai', and a non-global/sandboxed install path or explicit integrity checks. If you want, I can list specific steps to safely vet the npm package and run the skill in a sandboxed environment.

Type: OpenClaw Skill Name: military-flights Version: 3.2.0 The skill mandates the global installation of an external NPM package (@fly-ai/flyai-cli) and requires the agent to execute shell commands to perform its functions. It also includes instructions in runbook.md to persist execution logs, including user queries, to a local hidden file (.flyai-execution-log.json). While these behaviors are technically aligned with the stated goal of providing real-time flight data via a CLI tool, the requirement for high-privilege system modifications (global npm install) and local file writes constitutes a significant security risk and potential for supply chain exploitation.