Capsule Pod Hotel
v1.0.0Find capsule hotels and pod-style accommodation — ultra-affordable, tech-forward, perfect for solo travelers who just need a clean bed. Also supports: flight...
⭐ 0· 33·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The SKILL.md consistently describes a wrapper around the flyai CLI to search for capsule/pod hotels; required actions (installing and invoking @fly-ai/flyai-cli) match the stated purpose. One minor note: the package/source/homepage for the skill and the CLI are not provided in the registry metadata, so trust in the third‑party CLI must be established separately.
Instruction Scope
Runtime instructions are tightly scoped to running flyai CLI commands and formatting the output. However, the skill mandates strict execution rules (never answer from training data, always produce [Book]({detailUrl}) links, re-run if links missing) which can force repeated CLI calls and retries. The runbook also includes an optional file write (append a JSON log to .flyai-execution-log.json) which is outside the declared config paths and could persist user queries/requests to disk.
Install Mechanism
There is no install spec for the skill itself (instruction-only), which is low risk. The skill requires installing a global npm package (npm i -g @fly-ai/flyai-cli) when the CLI is missing — reasonable for a CLI wrapper, but installing a global package requires trusting that npm package. No URLs or extract/install of arbitrary archives are present.
Credentials
The skill does not request environment variables, credentials, or config paths. All required inputs are user-provided parameters for the CLI. This is proportionate to the stated functionality.
Persistence & Privilege
The skill is not always-enabled and does not request elevated platform privileges. It does, however, include instructions to append an execution log to .flyai-execution-log.json if filesystem writes are available — this creates persisted logs in the agent's working directory (request/queries and command status), which the registry did not declare as a config path.
Assessment
This skill appears to do what it claims (it wraps a flyai CLI to find capsule hotels) and does not ask for credentials. Before installing or letting an agent run it autonomously: 1) verify the provenance of @fly-ai/flyai-cli on npm (publisher, repository, reviews) because the skill requires installing that package globally; 2) be aware the skill may append execution logs to .flyai-execution-log.json in the working directory (which can contain raw user queries and command outputs) — if you don’t want persisted logs, run the agent in an isolated environment or disable/inspect that step; 3) note the skill enforces re-running the CLI until booking links appear, which can cause repeated network calls — consider running the CLI manually once to confirm results and behavior. If you need higher assurance, request the CLI source (GitHub repo) or run the CLI in a sandbox before granting the skill autonomous invocation.Like a lobster shell, security has layers — review code before you run it.
latestvk971btg0dpmj0qfr7456ghzkq98438qk
License
MIT-0
Free to use, modify, and redistribute. No attribution required.