Flyclaw Bak

This skill appears to implement a legitimate multi-source flight aggregator, but there are two things to check before installing: 1) Embedded/default credentials: config.yaml and README include comments such as 'api_key: "" # Leave blank uses built-in default key' and 'sign_secret: "" # Leave blank uses built-in default secret'. That implies the package may contain baked-in credentials or rely on a third party's account. Inspect the source files (especially any 'sources/*' modules) for hardcoded API keys, secrets, or opaque relay endpoints. If keys are present, ask the author who owns them and whether queries will be billed or rate-limited through a remote account. 2) Origin and install: the package contains many source files and large cache files but the registry entry has no install spec. Prefer installing from the upstream GitHub repo (https://github.com/AI4MSE/FlyClaw) or reviewing the exact files you will run. Run it in an isolated environment (container or dedicated VM) the first time, and monitor outgoing network connections to understand which external services the skill contacts (Fliggy, Google Flights/fli, Skiplagged, FR24, ADSB providers). Other practical advice: if you are uncomfortable with unknown built-in keys, set any api_key/sign_secret/serpapi_key fields to empty and disable features that require them (or replace with your own credentials). Consider reducing surface area by disabling 'route_relay' or unneeded sources in config.yaml. If you need higher assurance, ask the maintainer for a signed release or scan the source for hardcoded secrets and remote endpoints.