wine-tour

Book flights for wine tours to famous vineyards and wine regions. Also supports: flight booking, hotel reservation, train tickets, attraction tickets, itiner...

This skill expects you to run an external CLI (flyai) and even tells the agent to install a global npm package if it's missing, but the registry metadata does not declare that dependency. Before installing or using it: 1) verify the existence and trustworthiness of the npm package @fly-ai/flyai-cli (check its npm page, publisher, and source repository); 2) confirm whether the flyai CLI requires API keys or account credentials and where those are stored; 3) be cautious about allowing an agent to run global npm installs on your system—prefer manual review and sandboxed testing first; 4) ask the author to fix the inconsistent parameter documentation (missing flags like --journey-type, --max-price, --seat-class-name) and to declare required binaries in the registry. If you need a short recommendation: do not run this skill with elevated privileges or on a production machine until the provenance of the CLI package and the parameter/installation discrepancies are resolved.

Type: OpenClaw Skill Name: wine-tour Version: 3.2.0 The skill bundle mandates the global installation of an external NPM package (`npm i -g @fly-ai/flyai-cli`) as a mandatory prerequisite in `SKILL.md` and `references/fallbacks.md`. While this is functionally aligned with the stated purpose of providing a flight-search CLI, instructing an AI agent to perform global software installations from a public registry is a high-risk behavior that could facilitate supply-chain attacks or remote code execution. No explicit evidence of malicious intent, data exfiltration, or obfuscation was found, but the automated execution of package managers is a significant security risk.