Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Plan Weekend Trips — Short Getaways, Weekend Flights, 2-Day Hotel Deals & Mini Vacations
v3.2.0Plan the perfect 2-day weekend escape to nearby destinations — auto-suggests places within 2-3 hours that maximize your short break. Also supports: flight bo...
⭐ 0· 38·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill claims real-time flight/hotel/POI results and mandates using a flyai CLI for every answer — that aligns with needing a live data client. However, there is no homepage or source link for the skill or the @fly-ai/flyai-cli package, which leaves the provenance of the required client unclear.
Instruction Scope
Runtime instructions strictly require installing and invoking the flyai CLI and forbid using any training-data fallback. The runbook also instructs the agent to append an execution log to .flyai-execution-log.json if filesystem writes are available — this creates persistent data on disk (request/response logs) which may include user queries and should be disclosed to users.
Install Mechanism
Although the skill itself has no install spec, it instructs the agent to run npm i -g @fly-ai/flyai-cli if flyai is missing. Installing a global npm package is a supply-chain risk (postinstall scripts, arbitrary code). No trusted source or homepage for the CLI package is provided to verify authenticity.
Credentials
The skill declares no required environment variables or credentials, which looks minimal and appropriate. However, a real booking CLI often requires authentication or token configuration; the SKILL.md does not explain where or how flyai obtains credentials (interactive login, local config, environment variables), so credential handling is unclear.
Persistence & Privilege
always:false (good) and autonomous invocation is normal, but the runbook explicitly instructs appending execution logs to a local file (.flyai-execution-log.json) when filesystem writes are available. Combined with the global npm install, this creates persistent artifacts and modest privilege/persistence on the host.
What to consider before installing
Before installing or using this skill, verify the flyai client and the skill author: 1) Ask the skill owner for a homepage or source repo and confirm the @fly-ai/flyai-cli package on the npm registry (npmjs.com) — check publisher, versions, and download counts. 2) Inspect the package (or view its repository) for postinstall scripts or unusual permissions; prefer not to run a global npm install until you vet it. 3) Ask how flyai authenticates and where any tokens are stored; confirm it will not exfiltrate credentials. 4) Be aware the skill will append an execution log (.flyai-execution-log.json) to the working directory if writes are available — ask what data is logged and where it is stored/rotated. 5) If you want to test safely, run the CLI in an isolated environment (VM/container) or install it locally (not -g), and run npm audit / review package.json for scripts. If provenance or authentication handling is unclear or the package cannot be verified, avoid installing the CLI and decline to use the skill.Like a lobster shell, security has layers — review code before you run it.
latestvk976cj6b1g6rgbmc5tk2de340584rvvh
License
MIT-0
Free to use, modify, and redistribute. No attribution required.