expat-relocation

ReviewAudited by ClawScan on May 10, 2026.

Overview

This flight-search skill is coherent, but it tells the agent to install an unpinned global npm CLI at runtime, so you should review that before use.

Before installing, confirm you trust the flyai npm CLI and consider installing it manually or in a sandbox. Expect your origin, destination, dates, and preferences to be sent through the provider tooling, and verify any booking link before purchasing.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent may install third-party software globally on your computer before showing flight results.

Why it was flagged

This mandates a runtime global installation of an unpinned npm package. npm installs can execute package code and modify the local environment, while the package itself is not included for review here.

Skill content
If flyai-cli is not installed, install it first... `npm i -g @fly-ai/flyai-cli`
Recommendation

Only allow the install if you trust @fly-ai/flyai-cli. Prefer a user-approved, pinned, documented install step or run it in a sandboxed environment.

What this means

Your travel search details may be processed by the external flight-booking provider, and clicking results may take you to booking pages.

Why it was flagged

The skill directs the agent to send route/date parameters to the flyai CLI and present provider booking links. This fits the stated travel-booking purpose, but users should notice the external tool and links.

Skill content
`flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 2` ... `Every result MUST have a [Book]({detailUrl}) link.`
Recommendation

Use the skill only when you are comfortable sharing the itinerary details with the provider, and verify prices and URLs before booking.