military-leave

Search for military leave flights with armed forces travel options. Also supports: flight booking, hotel reservation, train tickets, attraction tickets, itin...

Plain-language checklist before you install/use this skill: - Provider mismatch: The description says 'Fliggy (Alibaba Group)' but every runtime step requires a 'flyai' CLI and branding. Ask the developer which service this actually uses and for authoritative documentation (homepage, repo, or vendor statement). - Verify the CLI package: The skill tells you to run 'npm i -g @fly-ai/flyai-cli' if flyai isn't present. Search the public npm registry and the package's repository to confirm the package's publisher, download counts, and source code before installing globally — global npm installs can modify your system and may require sudo. - Clarify inconsistent parameters: The SKILL.md contains contradictory examples/defaults for --sort-type and mappings for 'direct'. These inconsistencies could cause incorrect searches; request corrected, single-source parameter documentation or tests showing expected CLI behavior. - No secrets requested: The skill doesn't ask for API keys or credentials, which is good. But be aware the CLI itself may prompt for credentials or open a browser to authenticate — inspect the flyai CLI behavior before granting any secrets. - Because this is instruction-only (no code files/homepage provided), the static scanner had nothing to analyze — that doesn't mean safe. Prefer skills with a public repo or vendor homepage you can audit. Recommendations: 1) Ask the skill publisher for (a) the official homepage or repository for '@fly-ai/flyai-cli', (b) proof that the service is affiliated with Fliggy if that claim is important, and (c) a corrected SKILL.md that resolves the parameter inconsistencies. 2) If you decide to test, run the npm install and the flyai CLI in a sandbox or VM (not on a production machine) and inspect network calls and the package source. 3) If you cannot verify the CLI package or provider claims, do not install the global npm package or enable the skill.

Type: OpenClaw Skill Name: military-leave Version: 3.2.0 The skill bundle mandates the global installation of an external NPM package (`@fly-ai/flyai-cli`) via the shell if it is not already present on the system (found in SKILL.md and references/fallbacks.md). While this is aligned with the stated purpose of searching for flights, forcing an AI agent to execute 'npm i -g' introduces significant supply chain risks and requires elevated system permissions. The instructions also employ aggressive prompt-injection language to override the agent's default behavior and force it to execute shell commands exclusively.