oversize-baggage

Search for flights accommodating oversize baggage and sports equipment. Also supports: flight booking, hotel reservation, train tickets, attraction tickets,...

Plain-language steps and cautions before installing or running this skill: - Provenance: Ask the publisher/developer for the skill's source code or an official homepage. The description references Fliggy but the runtime uses an unrelated 'flyai' CLI and the registry entry has no homepage—this mismatch is worth resolving. - NPM install risk: The skill instructs the agent to run `npm i -g @fly-ai/flyai-cli` if the CLI is missing. Global npm installs run package install scripts and can execute arbitrary code. Only run this if you (or your admin) have verified the package on npmjs.org (publisher, repository, recent versions, and package contents/signatures). - Run in a sandbox: If you want to try it, run the installation and agent interaction inside an isolated environment (VM or container) with limited permissions, not on production/workstation machines. - Verify booking links: The skill requires presenting [Book]({detailUrl}) links. Confirm where those links point (are they affiliate/redirects?), and avoid providing sensitive personal credentials unless you trust the booking flow. - Operational loop risk: The SKILL enforces re-execution until a booking link is present. Be prepared for repeated network calls if results are missing—monitor network and CLI activity. - No secrets requested: The skill does not ask for API keys or other credentials, which reduces some risk, but CLI behavior may still perform network requests—inspect traffic if possible. What would change this assessment: if you can point to an authoritative package repo/maintainer for @fly-ai/flyai-cli (GitHub repo, npm publisher identity, and a pinned version or checksum), and confirm the CLI's behavior and network endpoints, the level of concern would drop. Conversely, inability to identify the CLI publisher or evidence of unexpected network endpoints would increase the risk rating.

Type: OpenClaw Skill Name: oversize-baggage Version: 3.2.0 The skill bundle instructs the AI agent to automatically perform a global installation of an external npm package (`npm i -g @fly-ai/flyai-cli`) if the CLI is missing. This behavior introduces a significant supply chain risk and potential for Remote Code Execution (RCE) on the host system. While the instructions appear aligned with the stated flight-search functionality, the automated execution of global installers is a high-risk pattern that could be used to compromise the environment. Primary indicators are found in SKILL.md and references/fallbacks.md.