Variflight

What to check before installing: - Confirm the API key requirement: the code and SKILL.md require VARIFLIGHT_API_KEY, but the registry metadata lists none. Ask the publisher to update registry metadata (declare VARIFLIGHT_API_KEY as the primary credential). - Verify the source: SKILL.md suggests cloning from https://github.com/variflight-ai/variflight-skill.git and talks to https://ai.variflight.com. Confirm that those domains/repositories are official and trustworthy before providing any API key. - Inspect config files referenced (~/.variflight.json, ~/.config/variflight/config.json, ~/.openclaw/workspace/.env.variflight) to ensure they don't contain unrelated secrets. Prefer storing the Variflight key in a minimal-scope secret (CI secret store or a purpose-built config file) rather than broad shell rc files. - Run the scripts in a restricted environment (sandbox/VM/container) if you need to test them, and monitor network calls to confirm they only contact the expected host (ai.variflight.com). - If you need stronger assurance, request the maintainer to: (1) publish a homepage/source link in registry metadata, (2) explicitly declare required environment variables in the registry, and (3) provide a reproducible package (checked release on GitHub) so you can verify integrity. Why I labelled this suspicious: The functionality and code are coherent with the described purpose, but the registry metadata omission of the required API key and the code's reading of user config paths create an unexplained mismatch that should be resolved before trusting the skill with secrets.