Plan Weekend Trips — Short Getaways, Weekend Flights, 2-Day Hotel Deals & Mini Vacations

Plan the perfect 2-day weekend escape to nearby destinations — auto-suggests places within 2-3 hours that maximize your short break. Also supports: flight bo...

Before installing or using this skill, verify the flyai client and the skill author: 1) Ask the skill owner for a homepage or source repo and confirm the @fly-ai/flyai-cli package on the npm registry (npmjs.com) — check publisher, versions, and download counts. 2) Inspect the package (or view its repository) for postinstall scripts or unusual permissions; prefer not to run a global npm install until you vet it. 3) Ask how flyai authenticates and where any tokens are stored; confirm it will not exfiltrate credentials. 4) Be aware the skill will append an execution log (.flyai-execution-log.json) to the working directory if writes are available — ask what data is logged and where it is stored/rotated. 5) If you want to test safely, run the CLI in an isolated environment (VM/container) or install it locally (not -g), and run npm audit / review package.json for scripts. If provenance or authentication handling is unclear or the package cannot be verified, avoid installing the CLI and decline to use the skill.

Type: OpenClaw Skill Name: weekend-trip Version: 3.2.0 The skill bundle requires the agent to perform high-risk operations, specifically the global installation of an external NPM package (`@fly-ai/flyai-cli`) and writing execution logs to the local filesystem (`.flyai-execution-log.json`). While these actions are aligned with the stated purpose of travel planning via a CLI tool, the use of `npm i -g` and shell-based logging in `SKILL.md` and `references/runbook.md` introduces significant security risks, such as potential privilege escalation or arbitrary code execution, without providing a mechanism to verify the integrity of the downloaded package.