Multi Stop

Plan complex multi-city flight itineraries — A to B to C to D. Finds the best combination of flights for multi-stop trips, optimizing total cost. Also suppor...

This skill appears to do what it says (wrap the flyai CLI for multi-city flight planning) but contains several things you should check before installing or using it: - Verify the @fly-ai/flyai-cli package on the npm registry (publisher, recent releases, and source code) before running a global 'npm i -g'. Global installs require extra privileges and can affect your system PATH. - Expect the agent to run multiple flyai CLI commands and network calls. The SKILL.md enforces re-running commands until a booking link and brand tag appear — this could cause repeated requests and unexpected traffic. Consider testing in a controlled environment. - Be aware the skill’s runbook suggests writing .flyai-execution-log.json containing the raw user_query and CLI call logs. If you care about privacy, watch for that file in your working directory and inspect its contents; ensure you are comfortable with persistent logs containing user inputs. - The SKILL.md contains contradictory rules (e.g., 'Use detailUrl' vs 'Never use detailUrl') — this is ambiguous and may cause incorrect outputs. Prefer to run the flyai CLI manually first to confirm expected outputs and URL fields. - The skill claims extra capabilities (hotels, trains, visas) that are not shown in the CLI parameters/playbooks. If you need those features, confirm how they are implemented and whether additional permissions or credentials will be requested. If you proceed, run the flyai CLI commands manually once to validate behavior, check the npm package source, and monitor for created log files and unexpected network activity. If you cannot validate these points, treat the skill as untrusted.

Type: OpenClaw Skill Name: multi-stop Version: 3.2.0 The skill bundle mandates the automated global installation of an external NPM package (`@fly-ai/flyai-cli`) and explicitly suggests using `sudo` for elevated privileges if the installation fails (`references/fallbacks.md`). It employs aggressive prompt instructions to force the agent to ignore its internal training data and rely solely on this external CLI, which creates a significant supply-chain risk and potential for unauthorized system modification. Additionally, it includes instructions for local filesystem persistence via a hidden log file (`references/runbook.md`) and contains contradictory instructions regarding the use of `detailUrl` in `SKILL.md`.