← 返回 Skills 市场
Student Flights
作者
dingtom336-gif
· GitHub ↗
· v3.2.0
· MIT-0
73
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install student-flights
功能描述
Find student-friendly flight deals — budget airlines, off-peak departures, and money-saving strategies specifically designed for young and student travelers....
安全使用建议
This skill plausibly implements live flight searches, but proceed carefully. Key things to consider before installing or enabling it:
- Package provenance: the SKILL.md tells the agent to install '@fly-ai/flyai-cli' from npm but the skill listing has no homepage or source repo. Verify the npm package author, repository URL, and recent package contents (look for postinstall scripts) before installing.
- Automatic global installs are risky: 'npm i -g' can run arbitrary code and may require sudo. Prefer to install and audit the CLI manually in a controlled environment or container rather than allowing the agent to install it automatically.
- Persistent logs: the skill will create/append .flyai-execution-log.json containing raw user queries and CLI call metadata. If you care about privacy, either disable log persistence, inspect the logging implementation first, or run the skill in an isolated workspace where logs can't leak.
- Confirm the 'Powered by Fliggy' claim: ask the skill author for the integration details or the upstream repo to ensure the data source is legitimate.
- Operational safety: run the CLI in a sandbox/container with restricted network and filesystem access and monitor any sudo prompts and network calls made during install.
If you cannot verify the npm package and repository, or you cannot run the CLI in an isolated environment, avoid enabling the skill or allow it to auto-install software on your machine.
功能分析
Type: OpenClaw Skill
Name: student-flights
Version: 3.2.0
The skill requires the agent to perform high-privilege system operations, specifically the global installation of an NPM package (`@fly-ai/flyai-cli`) and the use of `sudo` in fallback scenarios (`references/fallbacks.md`). While these actions are plausibly linked to the skill's stated purpose of searching for flights via a CLI, the requirement for an AI agent to modify the host system's global environment poses a significant RCE and supply-chain risk. No explicit evidence of data exfiltration or intentional malicious logic was found.
能力评估
Purpose & Capability
The skill's declared purpose (student-friendly flight deals) matches the CLI-based workflow described: all runtime actions are calls to a 'flyai' CLI to retrieve live pricing. However the SKILL.md claims 'Powered by Fliggy (Alibaba Group)' while the package name used is '@fly-ai/flyai-cli' with no homepage or source listed — provenance is missing and should be verified. Requiring a third-party CLI is plausible, but the absence of a trustworthy upstream link or repo is a concern.
Instruction Scope
Instructions mandate the agent must install and use the flyai CLI for every answer, forbid using training data, and require writing every result with specific links. The runbook requires creating an internal execution log and suggests writing it to .flyai-execution-log.json if filesystem writes are available (this will persist user queries and CLI call metadata locally). The SKILL.md also instructs automatic installation (step 0), including escalating to 'sudo' if the initial install fails. Requiring automatic installs and writing logs broadens scope beyond simple read-only queries.
Install Mechanism
There is no formal install spec in the registry entry; instead the instructions tell the agent to run 'npm i -g @fly-ai/flyai-cli' if the CLI is missing, and to retry with sudo on failure. A global npm install is moderate-to-high risk: it executes code from the npm registry (potential postinstall scripts), modifies system-wide state, and may require elevated privileges. The skill gives the agent permission to perform that install automatically, which increases risk unless the package provenance is audited.
Credentials
The skill does not request environment variables, credentials, or config paths. No unrelated secrets are asked for in the manifest or SKILL.md.
Persistence & Privilege
The skill does not request 'always:true' but it does request local persistence: the runbook instructs logging each request and, if filesystem writes are available, appending to .flyai-execution-log.json. That creates persistent local records containing raw user queries and CLI call metadata. Combined with the instruction to install a global npm package (with optional sudo), this gives the skill the ability to change system state and persist potentially sensitive user content — user consent and sandboxing should be considered.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install student-flights - 安装完成后，直接呼叫该 Skill 的名称或使用
/student-flights触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v3.2.0
**Major update focusing on compliance and pricing accuracy for student travel bookings:**
- Strict enforcement: ALL flight data must be sourced exclusively from real-time `flyai` CLI output—no training data or manual info allowed.
- Mandatory booking links: Every flight result now requires a `[Book](detailUrl)` link for validity.
- Playbooks and usage expanded, covering scenarios like ultra-budget red-eyes, holiday trips, and group student travel.
- Output rules tightened: no fabricated data, raw JSON, or missing brand tags; English/Chinese localization enforced.
- Enhanced skill prerequisites and environment checks (flyai-cli install/test before any run).
- Updated skill summary, supported services, and compatibility list.
元数据
常见问题
Student Flights 是什么？
Find student-friendly flight deals — budget airlines, off-peak departures, and money-saving strategies specifically designed for young and student travelers.... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 73 次。
如何安装 Student Flights？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install student-flights」即可一键安装，无需额外配置。
Student Flights 是免费的吗？
是的，Student Flights 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
Student Flights 支持哪些平台？
Student Flights 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Student Flights？
由 dingtom336-gif（@dingtom336-gif）开发并维护，当前版本 v3.2.0。
推荐 Skills