airport-pickup-service

ReviewAudited by ClawScan on May 10, 2026.

Overview

The skill mostly matches its airport-transfer purpose, but it also instructs the agent to keep a hidden local log of raw user travel queries without clear user control or retention limits.

Install only if you are comfortable with a global flyai CLI dependency and external travel search queries. Before using it with private itinerary details, disable or remove the execution-log behavior, or ensure .flyai-execution-log.json is not created and is deleted after use.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Your travel search details could be saved locally after the task, potentially exposing private itinerary information to later sessions or anyone with access to the workspace.

Why it was flagged

The skill directs the agent to persist raw user requests, which may include flight numbers, pickup addresses, hotel details, or travel times, in a local log that is not shown to users and has no stated retention or opt-out controls.

Skill content
Agent maintains this log internally. Not shown to users... "user_query": "{raw input}" ... echo '{generation_log_json}' >> .flyai-execution-log.json
Recommendation

Do not persist raw user queries by default. If logging is needed, ask the user first, redact sensitive itinerary details, document the file path, and provide clear cleanup/retention instructions.

What this means

Installing the skill may lead the agent to install and run a global npm command-line tool on your machine.

Why it was flagged

The skill depends on a globally installed npm CLI that is not declared in the registry requirements or install spec. This is expected for the skill's purpose, but it gives the external package local execution ability.

Skill content
If flyai-cli is not installed, install it first... npm i -g @fly-ai/flyai-cli
Recommendation

Review the @fly-ai/flyai-cli package source/provenance before installation, prefer pinned versions where possible, and consider installing it manually in a controlled environment.

What this means

Airport transfer search details you provide may be sent to the flyai/Alibaba travel service to retrieve results.

Why it was flagged

The skill is designed to query an external flyai provider for real-time booking data. This is purpose-aligned, but user travel search details are likely sent outside the local agent environment.

Skill content
Wraps the flyai-cli to provide real-time travel data with booking links.
Recommendation

Avoid entering unnecessary personal details unless required for the search, and review the provider's privacy practices before using it for sensitive travel plans.