last-seat-flight

PassAudited by ClawScan on May 10, 2026.

Overview

The skill appears to be a disclosed flight-search integration, but it relies on installing and running an external FlyAI CLI and returning third-party booking links.

This looks acceptable for a flight-search helper if you are comfortable installing the external FlyAI CLI and sharing route/date search details with its provider. Review the npm package and each command before allowing execution, and inspect Book links before making any purchase.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

First use may modify the local environment by installing an external CLI package.

Why it was flagged

The skill directs installation of a global npm CLI package if missing. This is central to the stated real-time flight-search purpose, but the package is unpinned and not included in the artifacts for review.

Skill content

FAIL: `command not found` ->

```bash
npm i -g @fly-ai/flyai-cli
flyai --version
```

Recommendation

Approve the npm install only if you trust the @fly-ai/flyai-cli package and prefer a global installation; consider checking the package source/version first.

Note

ASI02: Tool Misuse and Exploitation

What this means

Malformed or unexpected inputs could cause failed searches or unintended CLI arguments if not validated by the agent/runtime.

Why it was flagged

The skill runs local CLI commands with user-derived travel parameters, and one example uses a flag not listed in the main parameter table. This is purpose-aligned, but the host should keep parameter validation and command approval in place.

Skill content

NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below... `flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --journey-type 1 --sort-type 2`

Recommendation

Use only documented flyai flags, validate dates/city fields, and review commands before execution.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Your flight search details and any clicked booking links may be handled by the external travel provider.

Why it was flagged

The skill discloses an external travel provider flow and requires booking links from CLI output. Sharing route/date search details with the provider is expected for this integration.

Skill content

powered by Fliggy (Alibaba Group)... Every result MUST have a `[Book]({detailUrl})` link.

Recommendation

Avoid entering unusually sensitive travel details unless you are comfortable sharing them with the provider, and inspect booking links before purchasing.