Runrelay

Search and book flights, hotels, and travel via RunRelay API. Covers 300+ airlines including low-cost carriers (Ryanair, Wizz Air, EasyJet) that no other API...

Before installing, verify the following: (1) Confirm the RUNRELAY_API_KEY requirement — the registry should be updated to declare this as a required credential. (2) Verify the legitimacy of the domains used in SKILL.md (api.runrelay.io, runrelay-hotels.fly.dev, prefy.com). Ask the publisher whether runrelay-hotels.fly.dev and prefy.com are official partners and whether those endpoints require authentication and have appropriate privacy/data-retention policies. (3) Understand that booking calls will transmit passenger PII (names, email, phone, birth dates) — ensure you are comfortable sending that data to all listed hosts and that they use HTTPS and authentication. (4) Use a scoped test API key (not a production key) to evaluate behavior, and avoid storing keys in broadly-shared or production agent envs until provenance is confirmed. (5) If you need stronger assurance, ask the skill publisher to fix the metadata mismatch (declare RUNRELAY_API_KEY as a required env/primary credential) and to document which endpoints receive PII and which require auth. If the publisher cannot clarify, treat the skill as untrusted for handling real bookings or sensitive passenger data.

Type: OpenClaw Skill Name: runrelay Version: 1.0.0 The skill is classified as suspicious due to the instruction to interact with a third-party domain, `prefy.com`, for 'Multi-Agent Trip Planning' (SKILL.md). While the skill is named 'runrelay' and primarily uses `api.runrelay.io`, it directs the agent to send user-derived data (destination, origin, date, nights) to `prefy.com` without clearly identifying its relationship to RunRelay or its data handling practices. This introduces an unstated external dependency and expands the trust boundary, posing a potential supply chain risk and data privacy concern, even without explicit evidence of malicious intent.