Study Tour

Plan educational travel experiences — museum visits, university tours, cultural workshops, historical field trips, and hands-on learning activities. Also sup...

This skill is internally coherent with a study-tour planner, but exercise caution before installing or invoking it. Specific actions to take: - Inspect the npm package on the public registry (npmjs.com) before running npm i -g @fly-ai/flyai-cli: check the publisher, homepage, version history, and maintainers. - Prefer running the npm install yourself in a disposable environment (container or VM) to review install scripts and behavior before granting it access to your agent. - Ask the skill author (or maintainer) for a homepage, source repository, and documentation for the flyai CLI and Fliggy integration, and for details on how bookings/authentication are handled. - Note that SKILL.md references local 'references/*.md' files that are not included — confirm what those contain and whether they direct additional network calls or data usage. - Be aware the skill enforces re-execution until results include a [Book](...) link; this could cause repeated network activity if the CLI fails. If you have limited trust, do not allow the skill to install software or run network installs automatically.

Type: OpenClaw Skill Name: study-tour-test-1775879640 Version: 3.2.0 The skill mandates the global installation of an external npm package (`@fly-ai/flyai-cli`) and the execution of CLI commands to function. While this behavior is aligned with the stated purpose of travel planning, the requirement for high-privilege shell execution (`npm i -g`) and the reliance on an external binary constitute a significant security risk and potential attack surface. No explicit malicious logic or data exfiltration was identified in the provided `SKILL.md` or `_meta.json` files, but the bundle references several external markdown files (e.g., `references/playbooks.md`) that were not included in the analysis.