Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Flyai / Flight Price Watcher - 机票降价,我帮你盯着
v2.2.2机票价格监控 - 跟踪价格变动，降价自动提醒。触发词：监控机票、观望价格、机票提醒、价格波动、机票降价、盯着机票。
⭐ 2· 148·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description match the implementation: code calls a FlyAI CLI to search flights, persists tasks to data/tasks.json, and uses openclaw message send to push DingTalk alerts. Declared dependency (@fly-ai/flyai-cli) and the SKILL.md installation guidance align with this purpose.
Instruction Scope
Runtime instructions focus on searching flights, creating tasks, and sending notifications. The SKILL.md explicitly instructs installing FlyAI CLI and using cron/OpenClaw for scheduling. It does not attempt to read unrelated system files or exfiltrate secrets. Note: the skill executes external commands (flyai, openclaw) and includes guidance to run npm installs; this is expected for a CLI-driven skill.
Install Mechanism
No install spec is provided for the platform (instruction-only), but package.json lists @fly-ai/flyai-cli as a dependency and SKILL.md tells users to run npm i @fly-ai/flyai-cli. That's proportionate, but the platform will not automatically fetch external archives — the user must install the CLI separately.
Credentials
The skill requests no sensitive environment variables by default. package.json documents an optional DINGTALK_TARGET_ID for message targeting (reasonable). There are no unrelated credentials, and all required config paths are local (data/tasks.json).
Persistence & Privilege
always:false and user-invocable defaults are used. The skill stores its own data under data/tasks.json and does not attempt to modify other skills or system-wide configs. No elevated or permanent platform privileges are requested.
Assessment
This skill appears to do what it says: it calls a local FlyAI CLI to fetch flight data, stores tasks in data/tasks.json, and sends DingTalk notifications via openclaw message send. Before installing or running it:
- Only install the promised dependency (@fly-ai/flyai-cli) from a trusted source and verify that package's authenticity.
- Be aware the skill runs shell commands (flyai and openclaw) via child_process.exec; authors sanitize inputs, but executing commands always carries risk if an attacker can control inputs or the environment. Prefer running the skill in a limited environment.
- The skill stores task data locally (data/tasks.json). If you share your system, consider file permissions or moving storage to a safe location.
- Review or vet any jumpUrl links before clicking; they are returned by the CLI and open external booking pages.
If you want stronger assurance, ask the author for: a) cryptographic provenance (where @fly-ai/flyai-cli is published), b) a short security review of the CLI dependency, or c) an option to run API calls directly (instead of shelling out) or to use sandboxed execution.scripts/task_manager.js:312
Shell command execution detected (child_process).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.Like a lobster shell, security has layers — review code before you run it.
latestvk97660ktvy50m0s13kmyv93qqh843e3e
License
MIT-0
Free to use, modify, and redistribute. No attribution required.