Surfing Diving

Find surfing beaches, diving sites, and underwater adventures — wave forecasts, dive depth, marine life info, and equipment rental. Also supports: flight boo...

Before installing or enabling this skill, consider the following: (1) The skill requires installing a global npm package (@fly-ai/flyai-cli) but the registry metadata doesn't declare this — verify the package source and inspect its code or repository on npm/GitHub. Global npm installs run maintainer code and can alter your system PATH. (2) The skill's runbook suggests writing execution logs that include raw user queries to .flyai-execution-log.json — decide whether you want those query histories written to disk and confirm whether they are kept locally or transmitted elsewhere. (3) Ask the publisher for the CLI's homepage/repo, package checksum, and a privacy statement describing how booking requests and logs are handled. (4) If you must try it, run the CLI in a sandbox/container or avoid global install (use a VM or isolated environment), and audit the npm package first. Providing the skill author’s source repo or the flyai-cli project page would raise confidence; without that, proceed cautiously.

Type: OpenClaw Skill Name: surfing-diving Version: 3.2.0 The skill bundle is classified as suspicious because it instructs the agent to perform high-risk system operations, specifically the global installation of an external NPM package (`@fly-ai/flyai-cli`) and the execution of shell commands to retrieve travel data (found in SKILL.md and references/playbooks.md). Additionally, references/runbook.md directs the agent to write execution logs to a local file (.flyai-execution-log.json). While these behaviors are aligned with the stated purpose of providing real-time surfing and diving information, the requirement for broad system permissions and the reliance on external binaries represent a significant attack surface and potential supply-chain risk.