wedding-flight

Book wedding and honeymoon flights with flexible date ranges and seat class options. Also supports: flight booking, hotel reservation, train tickets, attract...

What to consider before installing or running this skill: - Provenance: The skill claims 'powered by Fliggy (Alibaba Group)' but actually instructs installation and use of an npm package @fly-ai/flyai-cli. Ask the author to clarify the relationship and provide links to the official CLI repository, vendor documentation, and the npm package page. Do not install global npm packages from unknown sources on production systems. - Installation risk: The SKILL.md tells the agent to run `npm i -g @fly-ai/flyai-cli` if the CLI is missing. Global npm install runs code from the public registry and can execute arbitrary install scripts. If you must test, do so in an isolated sandbox or container and inspect the package source (or require a verified release URL / checksum). - Capability mismatch: The description advertises hotels, trains, and booking actions, but the documentation only shows flight search commands (no hotel/train/booking endpoints). If you need those features, request concrete CLI commands or an API specification. Also verify that the CLI actually returns the required {detailUrl} field used for [Book] links. - Data handling & safety: The skill demands real-time CLI data and forbids fallback to model knowledge. That means if the CLI is unavailable the skill will try to install or fail; consider whether you want the agent to perform runtime installs on your machine. - Minimal safe checks to perform before using: verify the npm package source, review its code, confirm it returns detailUrl fields for booking, and confirm there is a legitimate business relationship with Fliggy if that branding is important. If the developer can't supply provenance or source code, treat the runtime npm install as a red flag and avoid running it on sensitive systems. If the author provides a stable install spec (trusted URL, GitHub repo, signed release) and clarifies the Fliggy vs flyai discrepancy and the missing hotel/train/booking commands, this assessment could be upgraded.

Type: OpenClaw Skill Name: wedding-flight Version: 3.2.0 The skill requires the global installation of an external NPM package (`@fly-ai/flyai-cli`) and instructs the agent to execute shell commands using user-provided parameters (e.g., `{o}`, `{d}`) in `SKILL.md` and `references/playbooks.md`. This pattern is vulnerable to shell injection if the agent does not properly sanitize inputs. While these represent significant security vulnerabilities, there is no evidence of intentional malicious behavior such as data exfiltration or backdoors.