lunar-new-year-flight
ReviewAudited by ClawScan on May 10, 2026.
Overview
The skill is coherent for flight searches, but it should be reviewed because it can direct the agent to install an unpinned global npm CLI before use.
Review before installing. If you use it, approve the flyai CLI installation explicitly, consider installing a verified pinned version yourself, and expect your flight-search details to be sent to the travel provider for real-time booking results.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent may modify your system and run third-party package installation code before showing flight results.
The skill mandates runtime installation of an unpinned global npm package before use. That package code is outside the provided artifacts and the metadata does not provide an install spec or required binary declaration.
If flyai-cli is not installed, install it first... npm i -g @fly-ai/flyai-cli
Require explicit user approval before installation, pin and verify the package version, declare the dependency in install metadata, and prefer a contained or local install.
Your travel query can cause the agent to run local CLI commands with your origin, destination, and date parameters.
The skill is explicitly command-driven and builds CLI calls from user-provided travel parameters. This is expected for real-time flight search, but it is still tool execution rather than passive advice.
**You are a CLI executor, NOT a knowledge base.** ... flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 2Review the command and parameters before execution, especially if any user-provided value contains unusual shell characters.
Your travel route, dates, and preferences may be sent to the flyai/Fliggy service to retrieve booking links.
The skill discloses use of an external travel provider and sends route/date search details through the flyai CLI. This is purpose-aligned, but it is an external data flow.
powered by Fliggy (Alibaba Group) ... flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}}Use the skill only if you are comfortable sharing those travel-search details with the provider and verify booking links before clicking.