travel-blind-box

• Risk level: Low
• Analyzed: Apr 1, 2026, 11:45 AM
• Findings: 0
• Version: 1.0.0

Overview

The skill is internally consistent with a travel 'blind-box' planner: its instructions, local scripts, and required interactions align with the stated purpose — no unrelated credentials, no remote download/install behavior, but it does store local history and forwards some user data to a third-party 'flyai' skill, which you should review before use.

This skill appears coherent with its travel-planner description, but consider these before installing: 1) The skill stores travel history and generated itineraries under ~/.qoderwork/travel-blind-box/ (history.json and output files). Those files can contain sensitive info (visited cities, booking confirmation numbers). Inspect or back up that directory and confirm you consent to local storage. 2) The SKILL.md instructs calls to a third-party 'flyai' skill for live data; using the skill will send your current city, dates, budget and the visited-cities list to that external skill — verify you trust flyai or avoid sending sensitive details. 3) Scripts run locally (Python). If you want extra safety, review the included .py files in a text editor or run the skill in a restricted/sandboxed environment. 4) The import_history feature can merge external history files — only import trusted files. If you prefer not to persist history, you can remove or inspect history.json (path documented in README) or run the skill in a temporary environment. Overall the package is internally consistent and not requesting unrelated credentials, but be mindful of local data persistence and external data sharing.