travel-emergency-assistant
v1.0.1在航班取消、酒店超售、景点关闭等行中突发场景下，一键生成含实时价格、预订链接、决策理由的「应急三选一」方案。聚焦高焦虑场景，提供情绪安抚 + 行动指引（最晚下单时间 + 交通接驳），而非单纯参数对比。适用于旅行途中遇到意外需要快速决策的场景。
⭐ 2· 37·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The skill is an instruction-only travel emergency assistant and all declared runtime actions (searching flights/hotels/POI) map to calling a FlyAI CLI; asking for no env vars or unrelated system access is coherent with its purpose.
Instruction Scope
The SKILL.md explicitly requires checking for and (if absent) installing and running the FlyAI CLI via shell commands (which flyai, npm install -g, flyai search-*). This requires executing system commands and network calls to the npm registry; the instructions do not ask the agent to read unrelated local files or secrets, but they do mandate installing and invoking an external binary.
Install Mechanism
No packaged install spec is bundled; instead the document instructs installing @fly-ai/flyai-cli from the public npm registry with npm install -g. Installing a global npm package is a moderate-risk operation (runs arbitrary code from npm) and should be validated (check package source, maintainers, and repository) before performing.
Credentials
The skill declares no environment variables, no credentials, and no access to unrelated config paths. That aligns with the stated functionality (it delegates data retrieval to the FlyAI CLI).
Persistence & Privilege
always is false and the skill is user-invocable; it does not request persistent system-wide configuration edits or access to other skills' credentials. The agent will need permission to run shell commands to install/execute the CLI, which is expected for this design.
Assessment
This skill is coherent: it delegates searches to a FlyAI CLI and otherwise asks for no secrets. Before installing or letting an agent run it: (1) Verify the @fly-ai/flyai-cli package (npm page, GitHub repo, maintainer) so you trust its provenance; (2) avoid running global npm installs with sudo unless you trust the package—prefer inspecting the package or running it in a contained environment; (3) be aware the agent will run shell commands (which/npm/flyai) and the CLI will make network requests to fetch live pricing/links; (4) confirm any booking/financial actions yourself—this skill provides guidance and links but should not be allowed to make payments automatically. If you cannot verify the FlyAI CLI source, treat the installation step as high risk and do not proceed.Like a lobster shell, security has layers — review code before you run it.
latestvk978nb5w7fv48p1ybzjrrahe0x84398j
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🚨 Clawdis