Flight
v1.0.1Search, compare, book, and manage flights with price tracking, multi-platform comparison, and loyalty optimization.
⭐ 0· 932·7 current·7 all-time
byIván@ivangdavila
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description (search, compare, book, track, loyalty) align with the included docs (search.md, booking.md, tracking.md, points.md, apis.md). The listed integrations (Amadeus, Duffel, Kiwi, FlightAware, etc.) are expected for a booking/search skill.
Instruction Scope
Runtime instructions direct the agent to persist preferences and data locally (~/flight/memory.md and ~/flights/ for searches, bookings, alerts, history) and to compare multiple platforms including scraped sources (apis.md explicitly notes scraping Google Flights). Storing PNRs/bookings and prompting for credentials are within scope but are sensitive; scraping Google Flights is a legal/risk note rather than pure functionality mismatch.
Install Mechanism
No install spec and no code files — instruction-only. This minimizes on‑disk installation risk; nothing is downloaded or executed by an installer.
Credentials
The skill declares no required env vars or credentials, which is coherent for an instruction-only skill. However apis.md references services (Amadeus, Duffel, AwardWallet, etc.) that require user credentials/API keys if used; the skill doesn't declare these upfront, so users may be asked interactively to provide sensitive credentials when connecting to those services.
Persistence & Privilege
always is false and the skill does not request system-wide privileges. It does request persistent storage in the user's home directory for preferences, searches, bookings, alerts, and history — normal for this purpose but potentially sensitive (unencrypted PNRs, loyalty numbers, travel history).
Assessment
This skill appears to do what it claims, but it will create and persist sensitive flight data (PNRs, booking confirmations, alerts, travel history) under ~/flight and ~/flights. Before installing: (1) decide whether you’re comfortable storing PNRs and loyalty numbers unencrypted in your home directory; (2) be cautious about providing API credentials (Amadeus, Duffel, AwardWallet, etc.) — prefer creating limited-scope keys and revoke them if unused; (3) note the skill suggests scraping Google Flights (legal/terms-of-service risk) and may prompt you to use scraping-based sources; (4) ask the publisher whether stored files are ever transmitted off-device or backed up remotely; and (5) consider keeping a separate folder with restricted permissions or encrypting stored files if you proceed. If you want greater assurance, request the skill author/publisher/source (it's currently unknown) and a privacy/data-flow statement describing network endpoints and credential handling.Like a lobster shell, security has layers — review code before you run it.
latestvk97cdvrf2pf4j6y9w54f49fv9s816y6y
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
✈️ Clawdis
OSLinux · macOS · Windows