fishing-trip

PassAudited by ClawScan on May 10, 2026.

Overview

This is a coherent travel-search skill, but it relies on an external FlyAI CLI that may be installed globally and sends trip queries to that provider.

Before installing, be comfortable with the agent running shell commands, possibly installing the FlyAI CLI globally via npm, and sending your travel search details to FlyAI/Fliggy. If you proceed, review or approve the exact install and search commands first.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Using the skill may modify your local environment by installing or updating a global CLI package.

Why it was flagged

The skill may install an external npm CLI globally at runtime; that package code is not included in the reviewed artifacts and no version pin is specified.

Skill content
If flyai-cli is not installed, install it first... `npm i -g @fly-ai/flyai-cli`
Recommendation

Approve the install explicitly, consider using an isolated environment, and verify the npm package/source before allowing the agent to install it.

What this means

The agent may run FlyAI CLI options that are not fully described in the main parameter list, though they remain travel-search related.

Why it was flagged

The instructions set a strict parameter boundary but then document at least one flag outside the main parameter table, which could make the agent's command scope less clear.

Skill content
`NEVER invent CLI parameters. Only use parameters listed...` ... `flyai search-flight ... --journey-type 1 --sort-type 2`
Recommendation

Review the command before execution, and the maintainer should align the parameter table with all documented playbooks and fallbacks.

What this means

Your origin, destination, dates, and travel preferences may be shared with the external FlyAI/Fliggy service to retrieve results.

Why it was flagged

Flight-search details are sent through an external provider CLI. This is disclosed and purpose-aligned, but provider-side handling is outside the supplied artifacts.

Skill content
powered by Fliggy (Alibaba Group) ... `flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}}`
Recommendation

Avoid entering unnecessary sensitive personal information, and review the provider's privacy terms if that matters for your trip details.