Trip Advisor

Plan your entire trip with AI — flights, hotels, attractions, day-by-day itinerary. Tell me your destination, dates, and interests, I'll handle the rest. Als...

Before installing or enabling this skill: (1) Understand it will try to run 'npm i -g @fly-ai/flyai-cli' at runtime — review the @fly-ai/flyai-cli package on npm (publisher, source code, popularity, recent changes) and prefer installing such CLIs in a sandbox/container rather than globally. (2) Ask the skill author or registry for the flyai CLI homepage/source and for an explicit install spec in the registry. (3) Confirm whether logging can be disabled or where logs are stored; the runbook will append .flyai-execution-log.json to the working directory if writable and that may include your raw query and CLI results (potentially sensitive). (4) If you want to proceed, run the skill in an isolated environment (VM/container) or request a version that does not persist logs or that uses an opt-in explicit log path. (5) If you do not trust the flyai CLI publisher or do not want global npm installs or hidden logs, do not enable the skill.

Type: OpenClaw Skill Name: trip-advisor Version: 3.2.0 The skill requires the agent to perform a global installation of an external NPM package (@fly-ai/flyai-cli) and execute multiple shell commands to retrieve travel data. While these actions are aligned with the stated purpose of travel planning, the automated installation of global software and the instruction to log execution details to a local file (.flyai-execution-log.json in references/runbook.md) represent high-risk behaviors. No explicit evidence of malicious intent or data exfiltration was found, but the broad execution permissions and dependency on an external package justify a suspicious classification.