trade-fair

Book flights for trade fairs and exhibition travel. Also supports: flight booking, hotel reservation, train tickets, attraction tickets, itinerary planning,...

This skill appears to be a honest CLI-driven flight search tool, but there are red flags you should consider before installing or using it: - Branding mismatch: the SKILL.md claims 'Powered by Fliggy (Alibaba Group)' but the runtime requires installing '@fly-ai/flyai-cli'—there's no homepage, repository, or documentation to verify this relationship. Ask the publisher for provenance and a link to the CLI's source. - Unverified npm package: the instructions tell you to run 'npm i -g @fly-ai/flyai-cli' if the CLI is missing. Installing a global npm package grants code the ability to run on your machine. Only install if you can inspect the package (npm page, repository, or published source) and trust the publisher. - Possible runtime prompts for credentials/payments: the skill doesn't explain how bookings are authenticated or how payments are handled. Be prepared for the CLI to prompt for credentials or to open external booking pages; avoid entering secrets unless you understand where they go. - Risk of repeated execution: the skill enforces re-running the CLI when its validation rules fail (e.g., missing [Book] links), which could result in repeated network calls. Consider running the CLI in a sandbox or test environment first. Recommended actions before installing or enabling this skill: 1. Request the CLI package's npm page and source repository from the author and review them (README, maintainer, issues, version history). 2. Verify whether 'flyai' actually interfaces with Fliggy or another provider. 3. If you must test, run npm installations in an isolated environment (container/VM) rather than on your primary workstation. 4. Do not provide sensitive credentials to the skill until you confirm how they are stored and used. 5. If you cannot verify provenance, decline installation or mark the skill as untrusted.

Type: OpenClaw Skill Name: trade-fair Version: 3.2.0 The skill instructs the agent to perform a global installation of an external NPM package (`npm i -g @fly-ai/flyai-cli`) if the CLI tool is missing (SKILL.md, references/fallbacks.md). While this behavior is aligned with the stated purpose of providing flight search capabilities, the automated global installation of third-party software is a high-risk operation that could facilitate remote code execution or supply chain attacks.