Travel Bundle

Find package deals combining hotel and flights — often 10-20% cheaper than booking separately. One search, one booking, complete trip. Also supports: flight...

This skill asks you (via the agent) to install and run a third-party CLI (npm i -g @fly-ai/flyai-cli) and to rely exclusively on its output, but the skill package provides no homepage, repository, or declared credentials needed for the CLI. Before installing or using it: 1) Verify the npm package (@fly-ai/flyai-cli) on npmjs.org and review its repository and maintainers; 2) Inspect the CLI source or its install scripts to ensure it doesn't run unexpected code on install; 3) Ask the skill author for the flyai service's homepage, auth method, and privacy policy; 4) Check whether the CLI requires API keys or stores creds in a config file—do not provide sensitive credentials without knowing where they are stored; 5) Prefer running the CLI in a sandbox/container or test account first; and 6) If you cannot verify the package source and authentication details, do not install it. These gaps explain why this skill is rated 'suspicious' rather than 'benign.'

Type: OpenClaw Skill Name: travel-bundle Version: 3.2.0 The skill mandates the global installation and execution of an external NPM package (`@fly-ai/flyai-cli`) and uses 'Critical Execution Rules' to force the agent to install and run this software before answering any queries. While these actions are aligned with the stated purpose of providing real-time travel data, the requirement for global administrative privileges and the enforcement of external code execution pose a significant supply chain risk. No explicit evidence of malicious intent, such as data exfiltration or persistence mechanisms, was found in the provided `SKILL.md` or `_meta.json` files.