eco-hotel

PassAudited by ClawScan on May 10, 2026.

Overview

This is mostly a disclosed travel-search wrapper, but it asks the agent to install and run a third-party npm CLI globally, so users should approve commands carefully.

Before installing, be aware that the skill may globally install and run @fly-ai/flyai-cli and send your travel search details to that provider. Use command approval, avoid privileged shells, and verify booking links and prices before clicking or purchasing.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Using the skill may install persistent third-party code on the user's machine before travel searches can run.

Why it was flagged

The skill depends on a third-party npm package installed globally at use time, and the package contents are not included in the supplied artifacts.

Skill content
If flyai-cli is not installed, install it first... `npm i -g @fly-ai/flyai-cli`
Recommendation

Only allow the install if you trust @fly-ai/flyai-cli; prefer command approval, a non-privileged environment, and a reviewed or pinned package version.

What this means

The agent may run provider CLI commands with user-derived travel details and could use inconsistent options, causing unexpected or failed searches.

Why it was flagged

The skill tries to constrain CLI parameters, but its own playbook uses a flag not listed in the main table, creating unclear command boundaries.

Skill content
`NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below.` ... `flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --journey-type 1 --sort-type 2`
Recommendation

Review command prompts before execution and verify that the CLI arguments match the travel request.

What this means

Users may expect hotel, train, attraction, or sustainability validation that is not shown in the artifacts.

Why it was flagged

The stated capability is broader than the provided flight-search workflows, which could make users overestimate what the skill actually verifies or books.

Skill content
description: "Book flights to eco-hotel and sustainable travel destinations. Also supports: flight booking, hotel reservation, train tickets, attraction tickets, itinerary planning, visa info, travel insurance, car rental, and more"
Recommendation

Treat the skill as a flight-search and booking-link helper unless additional reviewed workflows are provided, and verify booking and sustainability claims on the provider site.