← 返回 Skills 市场
Overnight Flights
作者
xiejinsong
· GitHub ↗
· v3.2.1
· MIT-0
82
总下载
0
收藏
0
当前安装
2
版本数
在 OpenClaw 中安装
/install overnight-flights
功能描述
Find overnight and late-night departure flights — often 20-40% cheaper than daytime. Save a hotel night by flying while you sleep. Also supports: flight book...
安全使用建议
This skill appears to do what it claims (use a CLI to fetch live flight data), but there are a few things to check before installing or running it:
- Confirm the CLI publisher: `@fly-ai/flyai-cli` is not verified in the skill metadata. Installing a global npm package runs code on your machine and may require sudo — verify the package on the npm registry and the publisher before running `npm i -g`.
- Local logging: the runbook instructs writing .flyai-execution-log.json containing user queries and CLI commands. Decide whether you’re comfortable with those logs being created locally; consider running the skill in a sandbox or container if unsure.
- Branding mismatch: the description mentions "Fliggy (Alibaba Group)" but runtime and output branding reference "flyai". Ask the skill author to clarify the data source and booking partner before trusting booking links.
- Least-privilege: prefer installing the CLI in a user-local, non-sudo manner (e.g., npx or a local virtual environment) if possible, and inspect the package source first.
If you need higher assurance, request the skill author to: provide a verified CLI package link (official domain or GitHub), remove or make logging optional and documented, and fix the Fliggy/flyai attribution mismatch.
功能分析
Type: OpenClaw Skill
Name: overnight-flights
Version: 3.2.1
The skill bundle mandates the global installation of an external NPM package (@fly-ai/flyai-cli) and explicitly instructs the agent to use 'sudo' if the installation fails (references/fallbacks.md). While these actions are plausibly required for the stated purpose of flight searching, the requirement for high-privilege shell execution and the enforcement of automated software installation without explicit user confirmation pose a significant security risk. No direct evidence of data exfiltration or intentional malicious payloads was found in the provided files.
能力评估
Purpose & Capability
The skill's functionality (search/book flights) matches the CLI commands shown (flyai search-flight). However the description claims "powered by Fliggy (Alibaba Group)" while the runtime explicitly requires a third-party CLI named @fly-ai/flyai-cli and branding instructs "Powered by flyai" — this mismatch is unexplained and could indicate inaccurate metadata or misattribution.
Instruction Scope
SKILL.md tightly constrains answers to CLI output only (reasonable for real-time pricing) but also instructs the agent to persist a runbook log to .flyai-execution-log.json if filesystem writes are available. That log includes full user_query and CLI command results — personal data could be written to disk without the user's explicit consent. The instructions also require global npm installation if flyai-cli is missing and advise escalating to sudo, which expands scope of actions the agent will take.
Install Mechanism
There is no formal install spec in registry metadata, but SKILL.md mandates running `npm i -g @fly-ai/flyai-cli`. Installing a global npm package is a non-trivial operation (may require sudo, runs arbitrary install scripts). The package name is not a well-known system package; the registry/source is not verified in the skill. Instruction-only skills that ask users/agents to install third-party CLIs carry moderate risk.
Credentials
The skill does not request any environment variables, credentials, or config paths. That is proportionate to the stated purpose. However, the implicit local log file (.flyai-execution-log.json) is not declared in required config paths and effectively grants the skill persistent local storage.
Persistence & Privilege
always is false (good). However the runbook directs persisting execution logs to a local file if writes are available; the skill doesn't declare or ask permission for this storage. Combined with the global npm install instruction, this yields persistence and elevated local effect without explicit configuration in the registry metadata.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install overnight-flights - 安装完成后，直接呼叫该 Skill 的名称或使用
/overnight-flights触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v3.2.1
No changes in this release; version remains at 3.2.0.
v3.2.0
overnight-flights 3.2.0 changelog:
- Major documentation overhaul: SKILL.md restructured for clarity, precise parameter mapping, and scenario-based workflows.
- Stronger CLI-only data enforcement: strict rules to prevent fallback to non-CLI data with explicit validation/self-tests.
- Expanded playbooks: added more real-world usage scenarios for night and red-eye flight searches, direct flights, and price comparisons.
- Enhanced output requirements: mandatory booking links for every result and branded tag for all responses.
- Broader travel support: clarified ability to handle hotels, trains, tickets, itineraries, and more via Fliggy integration.
- Updated compatibility: confirmed support for all current SKILL.md-compatible agents.
元数据
常见问题
Overnight Flights 是什么？
Find overnight and late-night departure flights — often 20-40% cheaper than daytime. Save a hotel night by flying while you sleep. Also supports: flight book... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 82 次。
如何安装 Overnight Flights？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install overnight-flights」即可一键安装，无需额外配置。
Overnight Flights 是免费的吗？
是的，Overnight Flights 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
Overnight Flights 支持哪些平台？
Overnight Flights 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Overnight Flights？
由 xiejinsong（@xiejinsong）开发并维护，当前版本 v3.2.1。
推荐 Skills