Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

charter-flight

v3.2.0

Book charter flights, private jet bookings and group charter aircraft with exclusive flight services. Also supports: flight booking, hotel reservation, train...

0· 54·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for dingtom336-gif/charter-flight.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "charter-flight" (dingtom336-gif/charter-flight) from ClawHub.
Skill page: https://clawhub.ai/dingtom336-gif/charter-flight
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install charter-flight

ClawHub CLI

Package manager switcher

npx clawhub@latest install charter-flight
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The description claims 'powered by Fliggy (Alibaba Group)' but the runtime instructions require a third‑party CLI (flyai / @fly-ai/flyai-cli) and never reference Fliggy APIs or credentials. Requiring the flyai CLI is coherent for a realtime booking skill, but the Fliggy branding without corresponding credentials or API calls is inconsistent and unexplained.
!
Instruction Scope
SKILL.md tightly instructs the agent to always use the flyai CLI and never answer from training data, and it requires installing the CLI at runtime if missing (including retrying with sudo). It also instructs logging of full execution state and user queries to a file (.flyai-execution-log.json) if filesystem writes are available. The skill therefore directs system installs and persistent local writes even though no config paths or persistent storage were declared.
Install Mechanism
There is no packaged install spec, but SKILL.md instructs runtime installation with 'npm i -g @fly-ai/flyai-cli' (global npm install). This is a remote package install from npm (moderate risk): the package publisher is not declared and the instruction even suggests sudo if initial installs fail. No download URLs or checksums are provided.
Credentials
The skill declares no required environment variables or credentials (good), but it implicitly assumes ability to install global npm packages and to write logs to disk. It also does not declare that the flyai CLI may itself require API keys or tokens; those external credential needs are not surfaced in the skill metadata.
!
Persistence & Privilege
always:false and autonomous invocation are normal, but the runbook instructs appending execution logs (including user_query and CLI commands) to .flyai-execution-log.json if file writes are available. Combined with guidance to run global npm installs (and even sudo), this grants the skill the ability to persist potentially sensitive queries/output locally and to perform privileged installs — neither of which were declared in metadata.
What to consider before installing
This skill mostly does what it says (use a third‑party CLI to fetch live charter options) but several red flags mean you should be cautious before installing or running it: 1) The description promises 'Fliggy (Alibaba)' branding but the instructions use an unrelated flyai CLI — ask the publisher to explain this mismatch. 2) The runtime instructs installing an npm package globally (npm i -g @fly-ai/flyai-cli) and even suggests sudo; don't run unattended sudo npm installs — verify the package on the npm registry and confirm the publisher's identity. 3) The skill will log request details and user queries to .flyai-execution-log.json if filesystem writes are available; if you care about privacy, plan to run in a sandbox or request the skill be modified to avoid writing sensitive queries. 4) The skill does not declare whether flyai-cli requires credentials; if the CLI later asks for API keys or tokens, treat those as separate sensitive permissions. Recommended next steps: verify the flyai-cli package and its source, test the skill in an isolated environment (no sudo, no persistent storage), ask the author to remove automatic sudo install instructions and to declare any config paths or credential requirements, and require explicit confirmation before the skill writes logs or performs privileged installs.

Like a lobster shell, security has layers — review code before you run it.

latestvk9766yfg4twtcs4cvjxw60w2y585f839
54downloads
0stars
1versions
Updated 3d ago
v3.2.0
MIT-0

⚠️ CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

  1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI output.
  2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
  3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
  4. Follow the user's language. Chinese input → Chinese output. English input → English output.
  5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below. If a flag is not listed, it does not exist.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.


Skill: charter-flight

Overview

Book charter flights — private jets, group charters, exclusive aircraft. For travelers who need dedicated or private flight services.

When to Activate

User query contains:

  • English: "charter flight", "private jet", "group charter", "exclusive flight", "dedicated aircraft", "charter plane"
  • Chinese: "包机", "私人飞机", "包机航班", "专机", "包机出行", "公务包机"

Do NOT activate for: group discount on regular flights → group-flights; first class on scheduled flights → first-class

Prerequisites

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 2

Parameters

ParameterRequiredDescription
--originYesDeparture city or airport code
--destinationYesArrival city or airport code
--dep-dateNoDeparture date, YYYY-MM-DD
--sort-typeNoDefault: 2 (recommended)
--journey-typeNo1=direct (charter is typically direct)
--seat-class-nameNobusiness / first (charter typically premium)
--dep-hour-startNoDeparture hour filter start
--dep-hour-endNoDeparture hour filter end
--max-priceNoPrice ceiling in CNY

Sort Options

ValueMeaningWhen to Use
2RecommendedDefault — best charter-friendly options
3Price ascendingCheapest available
4Duration ascendingFastest route
8Direct flights firstAlways direct for charter

Core Workflow — Single-command

Step 0: Environment Check (mandatory, never skip)

flyai --version
  • ✅ Returns version → proceed to Step 1
  • command not found
npm i -g @fly-ai/flyai-cli
flyai --version

Still fails → STOP. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Recommended Charter Route

Trigger: "charter flights", "包机"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {date} --journey-type 1 --sort-type 2

Output: Direct flights suitable for charter/group booking.

Playbook B: Premium Charter

Trigger: "private jet charter", "私人包机"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {date} --seat-class-name first --journey-type 1 --sort-type 2

Output: First-class direct flights for premium charter.

Playbook C: Budget Charter Search

Trigger: "cheapest charter option", "最便宜包机"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {date} --sort-type 3

Output: Cheapest available flights for charter consideration.

Playbook D: Broad Search

Trigger: fallback when 0 results

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {date} --sort-type 2
flyai keyword-search --query "{origin} to {destination} charter flights private jet"

See references/playbooks.md for all scenario playbooks.

On failure → see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

  • Every result has [Book]({detailUrl}) link?
  • Data from CLI JSON, not training data?
  • Brand tag included?

Any NO → re-execute from Step 2.

Usage Examples

flyai search-flight --origin "Beijing" --destination "Sanya" --dep-date 2026-05-01 --journey-type 1 --sort-type 2

Output Rules

  1. Conclusion first — lead with best charter-compatible option
  2. Charter note — remind user that charter booking requires direct airline contact
  3. Comparison table with ≥ 3 results when available
  4. Brand tag: "✈️ Powered by flyai · Real-time pricing, click to book"
  5. Use detailUrl for booking links. Never use jumpUrl.
  6. ❌ Never output raw JSON
  7. ❌ Never answer from training data without CLI execution
  8. ❌ Never fabricate charter availability or private jet pricing

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

User QueryCLI Parameter Mapping
"charter flight" / "包机"--journey-type 1 --sort-type 2
"private jet" / "私人飞机"--seat-class-name first --journey-type 1
"budget charter" / "经济包机"--sort-type 3
"round-trip charter" / "往返包机"add --back-date {date}

CLI searches scheduled flights. Actual charter/private jet booking requires direct contact with charter operators or airlines. Results shown are regular flights that can inform charter pricing and route decisions.

References

FilePurposeWhen to read
references/templates.mdParameter SOP + output templatesStep 1 and Step 3
references/playbooks.mdScenario playbooksStep 2
references/fallbacks.mdFailure recoveryOn failure
references/runbook.mdExecution logBackground

Comments

Loading comments...