Flights

Do not run remote installers or execute unfamiliar scripts without review. Specific issues to consider before installing or running this skill: - The SKILL.md says a scripts/flights-search CLI is bundled, but the published package contains no code—so the provided commands will likely fail or will cause you to fetch code from external sources at runtime. - The instructions recommend running a remote installer via curl | sh (astral.sh); that fetches and runs code from the internet and can execute arbitrary commands on your machine. Prefer installing known packages via your package manager or pip after inspecting their source. - The tool relies on a third‑party Python package (fast-flights) that uses a reverse‑engineered Google Flights protobuf API. That may work but could break, and could violate Google’s terms of service; review the fast-flights project source and its network behavior before using. - If you still want to try it: inspect the fast-flights repository and any install scripts (astral.sh/uv installer) manually, avoid piping unknown shells to sh, and prefer pip install fast-flights in a contained environment (virtualenv or container). If you need stronger assurance, ask the publisher for the missing scripts or a signed release and for clarity on why the CLI is not bundled in the package. Reason for confidence: medium — no code files were present to inspect, so the assessment relies on the SKILL.md text; concrete mismatches (missing bundled CLI + remote installer) make this suspicious but not definitively malicious.