← 返回 Skills 市场
Urgent Flights
作者
dingtom336-gif
· GitHub ↗
· v3.2.0
· MIT-0
63
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install urgent-flights
功能描述
Find flights departing within 48 hours. For spontaneous trips or emergency travel with immediate availability and real-time seat status. Also supports: fligh...
安全使用建议
Things to consider before installing: (1) The skill will try to install a global npm package (@fly-ai/flyai-cli) at runtime if the CLI is missing — review that package on npm/GitHub first or run in an isolated environment. (2) The SKILL.md says it will write an execution log (including the raw user query) to .flyai-execution-log.json — expect local persistence of whatever users input and verify you are comfortable with that. (3) The description mentions Fliggy but the CLI is flyai — ask the publisher to clarify the data/source and who operates the CLI/back-end. (4) If you do not want agents to install global packages or write files, do not grant those capabilities or run the skill in a sandbox. (5) If you need higher assurance, request the skill author to supply a declared install spec, the upstream package repository (source), and an explicit privacy statement describing what is logged and retained.
功能分析
Type: OpenClaw Skill
Name: urgent-flights
Version: 3.2.0
The skill mandates the global installation of an external NPM package (@fly-ai/flyai-cli) and explicitly instructs the agent to use sudo if the installation fails (references/fallbacks.md), which presents a risk of privilege escalation and arbitrary code execution. Additionally, it directs the agent to maintain a hidden local log of user queries and execution metadata in .flyai-execution-log.json (references/runbook.md). While these behaviors are functionally linked to the flight search utility, the requirement for administrative privileges and external dependencies without verification constitutes a high-risk security pattern.
能力评估
Purpose & Capability
Name/description: urgent last‑minute flights. Instructions and playbooks consistently focus on flight search and last‑minute scenarios. However the description claims “Powered by Fliggy (Alibaba Group)” while the runtime CLI is @fly-ai/flyai-cli — an unexplained branding mismatch. The description also lists many extra services (hotel, visa, insurance) but the SKILL.md only documents flight CLI commands. These are not definitive red flags but are inconsistent and worth checking with the publisher.
Instruction Scope
SKILL.md mandates always sourcing every answer from the flyai CLI and explicitly forbids using any training data. It requires installing the flyai CLI at runtime if absent and requires producing outputs with booking links from CLI JSON only. The runbook instructs persisting an execution log that includes the raw user query. Writing user queries to a local .flyai-execution-log.json file is not declared in the skill metadata and may persist potentially sensitive input. The skill also suggests escalating install attempts (commented fallback shows `sudo npm i -g ...`), which could require elevated privileges.
Install Mechanism
There is no declared install spec in the registry metadata, yet the runtime instructions require running `npm i -g @fly-ai/flyai-cli` if the CLI is missing. That means the agent will download and install a third‑party npm package at runtime. Installing a global npm package is a non‑trivial operation (network download, arbitrary code execution). The package is from the public npm ecosystem (traceable) but this runtime installation is not declared in the registry metadata and increases risk.
Credentials
The skill requests no environment variables or credentials, which is proportionate for a read-only flight search. However the runbook log includes the full user_query and CLI command history; those may capture PII (names, emails, passport fragments) if users include them. The skill does not declare any config paths but instructs writing to a local log file, so data persistence is not explicit in the metadata.
Persistence & Privilege
The skill will persist an execution log to .flyai-execution-log.json 'if file system writes are available' and logs raw user queries and CLI calls. This creates local persistence of user inputs and CLI results without that persistence being declared in the manifest. The skill does not request always:true, so it won't be force-enabled, but the logging behavior and the potential need to run global npm installs (with possible sudo) raise privilege/persistence concerns.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install urgent-flights - 安装完成后，直接呼叫该 Skill 的名称或使用
/urgent-flights触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v3.2.0
urgent-flights 3.2.0
- Strengthened CLI-only data sourcing: all outputs must originate from the flyai CLI command, never training data.
- Enforced output validation: every flight result must have a [Book]({detailUrl}) link to ensure authenticity.
- Added robust parameter handling and output SOPs referencing detailed scenario playbooks and templates.
- Tightened environment checks: now halts and instructs user if flyai CLI is not installed.
- Expanded trigger phrases and multilingual support for activation.
- Enhanced output formatting: comparison tables, brand tag, and strict markdown structure.
元数据
常见问题
Urgent Flights 是什么？
Find flights departing within 48 hours. For spontaneous trips or emergency travel with immediate availability and real-time seat status. Also supports: fligh... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 63 次。
如何安装 Urgent Flights？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install urgent-flights」即可一键安装，无需额外配置。
Urgent Flights 是免费的吗？
是的，Urgent Flights 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
Urgent Flights 支持哪些平台？
Urgent Flights 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Urgent Flights？
由 dingtom336-gif（@dingtom336-gif）开发并维护，当前版本 v3.2.0。
推荐 Skills