← 返回 Skills 市场
Search Morning Flights — Early Departures, Dawn Flights, First Flight Out, AM Flight Deals
作者
xiejinsong
· GitHub ↗
· v3.2.0
· MIT-0
73
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install morning-flights
功能描述
Find the earliest departing flights of the day — maximize your day at the destination by arriving before noon. Sorted by departure time. Also supports: fligh...
安全使用建议
This skill looks coherent with its stated purpose but has several practical risks you should consider before enabling it: (1) it requires installing a third‑party npm package globally (@fly-ai/flyai-cli) even though the skill metadata lacks an install spec — audit that package on npm (source code, maintainer, recent releases) before installing; (2) the instructions explicitly suggest using sudo if installation fails — avoid running sudo on untrusted packages; (3) the skill may write an execution log (.flyai-execution-log.json) containing the raw user query and CLI commands to disk — that could store sensitive information; (4) branding/integration inconsistency (mentions Fliggy but uses flyai CLI) should be clarified. Safer options: run the flyai CLI yourself in an isolated environment (or a sandbox VM/container) and provide the results to the agent, or ask the skill author for proof of the @fly-ai/flyai-cli package source and for the install to be documented in the skill metadata. If you must install, review the package code and avoid using sudo/global installs on production machines.
功能分析
Type: OpenClaw Skill
Name: morning-flights
Version: 3.2.0
The skill mandates the global installation of an external NPM package (`@fly-ai/flyai-cli`) and explicitly instructs the agent to use `sudo` if the initial installation fails, as seen in `references/fallbacks.md`. It also directs the agent to write execution logs to the local filesystem (`references/runbook.md`). While these high-privilege actions and the reliance on an external binary are plausibly related to the flight-search functionality, they represent a significant security risk through privilege escalation and external dependency execution.
能力评估
Purpose & Capability
The skill's name/description (search morning flights) coheres with its runtime behavior (run a flight-search CLI). However, the description mentions being "powered by Fliggy (Alibaba Group)" while the concrete CLI is @fly-ai/flyai-cli — a branding/integration inconsistency worth verifying. Also, the SKILL.md requires installing a global npm package even though the skill metadata contains no install spec; that mismatch is unexpected.
Instruction Scope
Runtime instructions mandate always using flyai CLI output (never use training data), require installing the CLI if missing, and enforce output formatting and the inclusion of booking links. The runbook instructs persisting an execution log including the raw user_query and CLI commands to .flyai-execution-log.json if file writes are available — this writes user data to disk. Fallbacks explicitly suggest using sudo to install the CLI. These behaviors go beyond simply querying an API and introduce data persistence and privilege-escalation suggestions.
Install Mechanism
There is no formal install spec in the skill metadata, yet the SKILL.md requires running `npm i -g @fly-ai/flyai-cli` (and falls back to `sudo npm i -g ...` if it fails). That means the skill effectively requires downloading and installing a third‑party npm package globally at runtime, which is higher risk than an instruction-only skill and should be audited before installation.
Credentials
The skill does not request environment variables or credentials (proportionate for a search helper). However, it will log the 'user_query' and CLI commands to a local file if possible; those logs can contain sensitive inputs. The skill also implicitly requires network access to the flyai service via the CLI.
Persistence & Privilege
Although always:false (no forced inclusion), the skill's instructions lead to persistent changes: global npm package installation and optional logfile writes in the working directory. The fallback advice to use sudo for installation increases privilege escalation risk if followed.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install morning-flights - 安装完成后，直接呼叫该 Skill 的名称或使用
/morning-flights触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v3.2.0
Renamed and optimized per naming methodology v3
元数据
常见问题
Search Morning Flights — Early Departures, Dawn Flights, First Flight Out, AM Flight Deals 是什么？
Find the earliest departing flights of the day — maximize your day at the destination by arriving before noon. Sorted by departure time. Also supports: fligh... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 73 次。
如何安装 Search Morning Flights — Early Departures, Dawn Flights, First Flight Out, AM Flight Deals？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install morning-flights」即可一键安装，无需额外配置。
Search Morning Flights — Early Departures, Dawn Flights, First Flight Out, AM Flight Deals 是免费的吗？
是的，Search Morning Flights — Early Departures, Dawn Flights, First Flight Out, AM Flight Deals 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
Search Morning Flights — Early Departures, Dawn Flights, First Flight Out, AM Flight Deals 支持哪些平台？
Search Morning Flights — Early Departures, Dawn Flights, First Flight Out, AM Flight Deals 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Search Morning Flights — Early Departures, Dawn Flights, First Flight Out, AM Flight Deals？
由 xiejinsong（@xiejinsong）开发并维护，当前版本 v3.2.0。
推荐 Skills