Travel Search

Find the best travel deals by searching and comparing flights, hotels, Airbnb stays, car rentals, and ferries across multiple providers simultaneously. Smart...

Security Scan

The skill's code and runtime instructions align with its travel-search purpose: it uses curl to call remote MCP endpoints, requests no credentials, and has no install steps — but review the included shell helper and verify external endpoints before running.

Purpose & Capability

Name/description (search flights/hotels/ferries/etc.) match the declared runtime behavior: the SKILL.md documents calling MCP servers for Kiwi, Skiplagged, Trivago, Ferryhopper, optional local Airbnb/fli MCPs. Required binaries (only curl) and no env vars are proportionate to the stated purpose.

Instruction Scope

Instructions are focused on making JSON-RPC (MCP) calls via curl, parsing SSE and header files in /tmp (examples use curl -D /tmp/...). They do not ask for unrelated local secrets or global system reads. Note: examples show writing/reading temporary header files and using shell parsing (grep/awk), and the skill tells the agent to include booking deep links and explain trade-offs — all within expected scope for a travel aggregator.

Install Mechanism

No install spec — instruction-only skill. The repository includes a small helper shell script (scripts/mcp-call.sh) but there is no automatic download or archive extraction. This is the lower-risk model for skills; still inspect the helper script before executing.

Credentials

The skill declares no required environment variables, no credentials, and no config-path access. That is appropriate for a skill that performs unauthenticated HTTP calls to public MCP endpoints and for optional local MCP services the user must install separately.

Persistence & Privilege

The skill does not request always:true, does not modify other skills, and does not require persistent presence or elevated privileges. It relies on agent-run network calls only.

Assessment

This skill appears coherent with its travel-search description and mostly performs straightforward network calls to public MCP endpoints using curl. Before installing or invoking it: 1) Inspect scripts/mcp-call.sh to confirm it only wraps safe curl/json parsing and does not exfiltrate local files or secrets. 2) Verify the listed MCP endpoints (mcp.kiwi.com, mcp.skiplagged.com, etc.) are legitimate and accessible from your environment and that they accept unauthenticated MCP calls (some provider APIs may require keys or have usage policies). 3) Be aware the agent will make outbound HTTP requests and write temporary header files (examples use /tmp/*.txt); if you run agents with sensitive local credentials, ensure they are not exposed. 4) Optional providers (Airbnb via @openbnb/mcp-server-airbnb, fli) require separate, local installation (Node/Python) that you should install and review yourself. If you need higher assurance, ask the skill author for provenance (source repo/homepage) or perform a minimal test in a sandboxed environment first.

Search flights, hotels, car rentals, and ferries across multiple free providers via MCP protocol.

Quick Reference

Need	Provider	Reference
Flights (creative routing)	Kiwi.com	flights.md
Flights + Hotels + Cars	Skiplagged	skiplagged.md
Hotels (price comparison)	Trivago	hotels.md
Ferries	Ferryhopper	ferries.md
Flights (Google Flights)	fli	google-flights.md
Full trip itinerary	Multi-provider	trip-planner.md
Best deal / price compare	Multi-provider	price-tools.md
Airbnb / apartment stays	Airbnb MCP	airbnb.md
Multi-city route optimizer	Multi-provider	multi-city.md
Destination intel (weather, visa, transport)	General knowledge + wttr.in	travel-intel.md

How It Works

All providers use the MCP protocol (JSON-RPC 2.0 over HTTP). Call them with curl:

# 1. Initialize session
curl -s -X POST "$MCP_URL" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"openclaw","version":"1.0"}}}'

# 2. Extract Mcp-Session-Id from response headers (if returned)

# 3. Call a tool
curl -s -X POST "$MCP_URL" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "Mcp-Session-Id: $SESSION_ID" \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"TOOL_NAME","arguments":{...}}}'

Response format: SSE with event: message + data: {JSON}. Parse the data line.

Decision Guide

User wants flights, hotels, cars, ferries, or trip planning

Read price-tools.md for the decision tree and comparison engine. It covers:

• Which providers to search and when
• How to compare and score results across providers
• How to present the single best recommendation + alternatives
• Flexible dates, anywhere destinations, round-trip optimization

For full trip itineraries, also read trip-planner.md. It includes a guided intake questionnaire (7 quick questions in one message) for when users want help figuring out what they want.

User wants to visit multiple cities

Read multi-city.md for route optimization. It finds the cheapest city order, allocates days, and handles open-jaw flights.

Core principle

Always search multiple providers, score results, and present ONE best recommendation with alternatives. The user should never have to compare — that's the agent's job. See price-tools.md for the value scoring system.

Presenting Results

Use bullet lists (no markdown tables on Discord/WhatsApp). For each option show:

• Route with stops (e.g., OVD → BCN → FCO)
• Times and duration
• Price
• Booking link

Group by: 💸 Cheapest → ⚡ Fastest → 🎯 Best value

Always include booking deep links so the user can act immediately.

Provider Endpoints

Kiwi:        https://mcp.kiwi.com
Skiplagged:  https://mcp.skiplagged.com/mcp
Trivago:     https://mcp.trivago.com/mcp
Ferryhopper: https://mcp.ferryhopper.com/mcp

Notes

• All Tier 1 providers are free, no API key needed
• Kiwi uses dd/mm/yyyy date format
• Skiplagged uses YYYY-MM-DD date format
• Always resolve city names to IATA codes first when using Skiplagged
• Rate limit: be reasonable, don't spam requests
• MCP sessions may expire; re-initialize if you get errors