red-eye-flight

Book red-eye flights with late night departure and overnight arrival. Also supports: flight booking, hotel reservation, train tickets, attraction tickets, it...

This skill appears to do what it says: it requires the flyai CLI and instructs the agent to use that CLI for all answers. Before installing or enabling it, verify the @fly-ai/flyai-cli package on npm (publisher, repository, recent versions, and open-source code) and prefer installing in a sandbox or ephemeral environment rather than your production system because 'npm i -g' runs code on your host. If you don't trust or can't verify the CLI publisher, decline or require manual review. Also be aware the agent will execute commands on the host (including installing software) when run — allow only if you trust that behavior.

Type: OpenClaw Skill Name: red-eye-flight Version: 3.2.0 The skill bundle requires the agent to perform global system modifications by executing 'npm i -g @fly-ai/flyai-cli' if the tool is not present (SKILL.md, fallbacks.md). Additionally, the command construction logic for 'flyai search-flight' uses direct parameter substitution (e.g., --origin "{{o}}") which is highly vulnerable to shell injection if the agent does not strictly sanitize user input. While these actions are aligned with the stated purpose of flight booking, the combination of high-privilege installation and potential RCE via shell injection poses a significant security risk.