photography-trip

Book flights for photography trips to scenic destinations. Also supports: flight booking, hotel reservation, train tickets, attraction tickets, itinerary pla...

This skill looks like a flight-search wrapper that expects to call an external CLI, but there are several inconsistencies and modest risks you should consider before installing: - Capability mismatch: The description advertises many travel services and claims 'powered by Fliggy', yet the instructions only show a flyai CLI for flight searches. Ask the author to explain how hotels, trains, bookings, and Fliggy integration work, and to provide authoritative API/CLI docs or a code repo. - npm install risk: The skill instructs the agent to run `npm i -g @fly-ai/flyai-cli` if the CLI is missing. Installing an unvetted global npm package can execute arbitrary code. Verify the package on npm (publisher, stars, repository, recent activity) and prefer installing in a controlled/sandboxed environment first. - Booking links and trust: The skill requires returning `[Book]({detailUrl})` links from CLI output. Before using those links for purchases, inspect the target domains and validate they are correct and trustworthy (the skill does not document where detailUrl points). - Operational safety: Require the agent not to auto-install global packages without explicit approval. If you want to proceed, test the skill in an isolated environment, ask the maintainer for provenance of @fly-ai/flyai-cli and clarification about the 'Fliggy' claim, and confirm how payments/credentials (if any) are handled. If the author can provide a verified CLI package repository or documentation that reconciles the Fliggy claim and the broader travel features, the concerns could be resolved.

Type: OpenClaw Skill Name: photography-trip Version: 3.2.0 The skill requires the agent to autonomously perform a global installation of an external NPM package (@fly-ai/flyai-cli) and execute CLI commands (SKILL.md, references/fallbacks.md). While these actions are aligned with the stated flight-booking purpose, the instruction for an agent to self-install software and the forceful 'CRITICAL EXECUTION RULES' that mandate CLI usage over internal knowledge represent a high-risk execution pattern. This pattern could be leveraged for remote code execution (RCE) or a supply chain attack if the external package is malicious or compromised.