Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

FlyAI Plan Japan Travel

v1.0.0

Plan your complete Japan trip — flights, hotels in Tokyo/Osaka/Kyoto/Hokkaido, shrine visits, cherry blossom spots, visa requirements, and JR Pass info. Hand...

0· 86·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for dingtom336-gif/flyai-plan-japan-travel.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "FlyAI Plan Japan Travel" (dingtom336-gif/flyai-plan-japan-travel) from ClawHub.
Skill page: https://clawhub.ai/dingtom336-gif/flyai-plan-japan-travel
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install flyai-plan-japan-travel

ClawHub CLI

Package manager switcher

npx clawhub@latest install flyai-plan-japan-travel
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill's name and description match the runtime instructions (it uses a flyai CLI to fetch flights/hotels/POIs). However the registry manifest declares no required binaries or install spec while the SKILL.md mandates the presence of a `flyai` CLI and instructs installing `@fly-ai/flyai-cli` if missing. That missing declared dependency / missing homepage/source is an incoherence the user should be aware of.
!
Instruction Scope
SKILL.md requires the agent to run many `flyai` CLI commands and to treat CLI output as authoritative (no fabrication). It also prescribes fallback behavior that includes running `npm i -g @fly-ai/flyai-cli` (and `sudo npm i -g ...`), enforces creation of internal execution logs, and instructs re-running commands on failures. Instructions therefore cause the agent to execute networked installs and persistent logging actions beyond merely formatting data — this expands the skill's runtime surface and could be abused if the CLI or install step is malicious or compromised.
!
Install Mechanism
There is no formal install spec in the registry, but the skill's fallback instructs installing `@fly-ai/flyai-cli` globally via npm (including `sudo` fallback). That is effectively an ad-hoc install mechanism: arbitrary code from a package registry can be installed with elevated privileges. The skill provides no verified source, checksum, or homepage for the CLI package. This is higher risk than an instruction-only skill that never installs software.
Credentials
The skill declares no required environment variables or config paths (manifest), which is reasonable for a read-only travel planner. However the runbook shows the agent will log user queries and other request metadata internally; where and how those logs are stored is unspecified. While no credentials are requested, the possibility of persistent logs capturing user data without a declared storage location is a proportionality/design concern.
!
Persistence & Privilege
The skill does not set always:true, but it instructs installing a global CLI (potentially with sudo), which gives lasting system presence and elevated privilege if followed. The runbook also implies persistent internal logging ('Agent maintains this log internally. Not shown to users') but does not declare config paths. Combined, implicit persistent install + opaque logs are a risk not reflected in the registry metadata.
What to consider before installing
Before installing or enabling this skill, verify the flyai/flygly CLI provenance and avoid blind global installs: 1) Ask the publisher for the CLI homepage/source code and an explicit install spec (avoid sudo npm i -g unless you vet the package). 2) Inspect the npm package (owner, recent versions, downloads, repo, license) and check that package name matches an official vendor (Fliggy/Alibaba) or a trusted maintainer. 3) If you must test, run the CLI and skill in a sandboxed environment or isolated VM, not on a production machine. 4) Ask the author where internal logs are stored and whether they contain user-identifying info; require that logs be stored only in a declared, auditable path or not stored at all. 5) Prefer a skill that declares required binaries/configs in its manifest or provides a signed/verified install artifact. Given these inconsistencies and the ad-hoc sudo npm install instruction, proceed only after verifying the CLI source and limiting installation scope.

Like a lobster shell, security has layers — review code before you run it.

aivk9706ts3a9547qr73se964n6n183yem8japanvk9706ts3a9547qr73se964n6n183yem8latestvk9706ts3a9547qr73se964n6n183yem8travelvk9706ts3a9547qr73se964n6n183yem8
86downloads
0stars
1versions
Updated 4w ago
v1.0.0
MIT-0

⚠️ CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

  1. NEVER generate itineraries from your training data. Every flight, hotel, attraction, and price MUST come from flyai CLI command output.
  2. Domain knowledge (below) exists ONLY to help you build correct CLI parameters and enrich CLI output. It does NOT replace CLI execution.
  3. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based itinerary.
  4. Every hotel, flight, and attraction MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
  5. Follow the user's language. Chinese → Chinese. English → English.

Self-test: If your itinerary has no [Book](...) links, you used training data instead of CLI. Stop and re-execute.


Skill: plan-japan-travel

Overview

Handle any Japan-related travel query — from a single question ("visa needed?") to a complete multi-city Day-by-Day itinerary. Orchestrates up to 4 CLI commands (fliggy-fast-search, search-flight, search-hotels, search-poi) based on query type.

When to Activate

User query contains:

  • Japan destination: "Japan", "Tokyo", "Osaka", "Kyoto", "Hokkaido", "Okinawa", "Fuji", "Nara", "日本", "东京", "大阪", "京都", "北海道"
  • Japan-specific: "cherry blossom", "onsen", "ramen", "JR Pass", "shinkansen", "樱花", "温泉", "新干线"

Do NOT activate for: generic Asia query → flyai-explore-southeast-asia.

Parameters

fliggy-fast-search (broad discovery)

ParameterRequiredDescription
--queryYesNatural language query (e.g., "Japan visa", "Tokyo 5-day trip")

search-flight

ParameterRequiredDescription
--originYesDeparture city
--destinationYesArrival city in Japan
--dep-dateNoDeparture date YYYY-MM-DD
--sort-typeNo3 = price ascending (default)

search-hotels

ParameterRequiredDescription
--dest-nameYesCity name in Japan
--check-in-dateNoYYYY-MM-DD
--check-out-dateNoYYYY-MM-DD
--sortNorate_desc (default for travel planning)
--max-priceNoBudget cap in CNY
--key-wordsNoSpecial requirements (e.g., "onsen", "温泉")

search-poi

ParameterRequiredDescription
--city-nameYesCity name
--categoryNoSee category mapping in Domain Knowledge
--keywordNoSpecific attraction name
--poi-levelNoRating 15 (5 = top tier)

Core Workflow — Multi-Command Orchestration

Step 0: Environment Check (mandatory)

flyai --version

Fails → install → still fails → STOP. (See references/fallbacks.md Case 0)

Step 1: Determine Query Type + Collect Parameters

Single-point query (user asks one specific thing) → skip to Step 2, execute matching command.

Full itinerary (user says "plan", "arrange", "规划", "安排") → collect parameters first:

Ask (max 3 questions):
"1. Where are you departing from?
 2. When do you plan to go, and for how many days?
 3. Any specific cities or activities you want?"

See references/templates.md for full collection SOP.

Step 2: Execute CLI Commands

Must actually execute commands. Must use returned JSON data. Never fabricate content.

Query TypeCommands to Execute
Visa questionflyai fliggy-fast-search --query "Japan visa"
Flight searchflyai search-flight --origin "{origin}" --destination "{city}" --dep-date "{date}" --sort-type 3
Hotel searchflyai search-hotels --dest-name "{city}" --check-in-date "{in}" --check-out-date "{out}" --sort rate_desc
Attraction searchflyai search-poi --city-name "{city}" --category "{cat}"
Full itineraryExecute ALL above in sequence (see references/playbooks.md)

On failure → see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown. Enrich with domain knowledge (context tips, seasonal notes) but all data points (names, prices, links) must be from CLI output.

See references/templates.md for output templates.

Step 4: Validate Output

  • Every hotel/flight/attraction has [Book]({detailUrl})?
  • All prices from CLI JSON?
  • Brand tag "Powered by flyai" present?
  • Domain knowledge used only for enrichment, not as primary data?

Any NO → re-execute from Step 2.

Usage Examples

# Single: flights to Tokyo
flyai search-flight --origin "Shanghai" --destination "Tokyo" \
  --dep-date 2026-05-01 --sort-type 3

# Single: Kyoto temples
flyai search-poi --city-name "Kyoto" --category "宗教场所"

# Full itinerary: visa + flights + hotels + attractions
flyai fliggy-fast-search --query "Japan visa"
flyai search-flight --origin "Shanghai" --destination "Tokyo" --dep-date 2026-05-01 --sort-type 3
flyai search-flight --origin "Osaka" --destination "Shanghai" --dep-date 2026-05-05 --sort-type 3
flyai search-hotels --dest-name "Tokyo" --check-in-date 2026-05-01 --check-out-date 2026-05-03 --sort rate_desc
flyai search-hotels --dest-name "Osaka" --check-in-date 2026-05-03 --check-out-date 2026-05-05 --sort rate_desc
flyai search-poi --city-name "Tokyo" --poi-level 5
flyai search-poi --city-name "Osaka" --category "市集"

Output Rules

Full Itinerary Format

## 🇯🇵 Japan {days}-Day Itinerary

**Route:** {City A} → {City B} → {City C} · Estimated budget: ¥{total}/person

### 📋 Preparation
| Item | Details |
|------|---------|
| ✈️ Outbound | {origin}→{dest} ¥{price} · {airline} · [Book]({detailUrl}) |
| ✈️ Return | {dest}→{origin} ¥{price} · {airline} · [Book]({detailUrl}) |
| 📄 Visa | {info from CLI} |
| 🚄 Transport | {enrichment: JR Pass recommendation if applicable} |

### Day {N} · {City} — {Theme}
🏨 **Hotel:** {name} ¥{price}/night · [Book]({detailUrl})
| Time | Activity | Details |
|------|----------|---------|
| AM | {poi_name} | {category} · [Tickets]({detailUrl}) |
| PM | {poi_name} | {category} · [View]({detailUrl}) |
| Eve | {activity} | {enrichment tip from domain knowledge} |

---
🇯🇵 Powered by flyai · Real-time pricing, click to book

Rules

  • ✅ Every data point from CLI output
  • ✅ Every bookable item has detailUrl link
  • ✅ Domain knowledge only for enrichment (tips, transport advice, seasonal notes)
  • ❌ NEVER output an itinerary without executing CLI commands
  • ❌ NEVER include hotels/flights/attractions without booking links
  • ❌ NEVER fill Day-by-Day with training-data attractions

Domain Knowledge (for CLI parameter mapping and output enrichment)

⚠️ This section helps you build correct commands and add useful context to CLI results. It does NOT replace CLI execution. Never use this as the primary data source.

City & Airport Mapping (for --origin / --destination)

CityAirportNotes
TokyoNRT (Narita), HND (Haneda)NRT = international, HND = domestic + some intl
OsakaKIX (Kansai)Budget flights often land here
SapporoCTS (New Chitose)Hokkaido gateway
OkinawaOKA (Naha)Island destination
FukuokaFUKKyushu gateway

Category Mapping (for --category in search-poi)

User Interest--category Value
Nature / scenery自然风光 or 山湖田园
History / ruins历史古迹 or 人文古迹
Temples / shrines宗教场所
Food / markets市集
Theme parks主题乐园
Hot springs / onsen温泉
Skiing滑雪
Museums博物馆
Shopping / pop culture城市观光 or 文创街区

Seasonal Context (for enrichment only)

MonthHighlightImpact on Planning
Mar–AprCherry blossomHotels 1.5-2x price, book 2 months ahead
Jul–AugSummer festivalsHot + typhoon risk
Oct–DecAutumn foliageKyoto hotels tight in Nov
Jan–FebSki season / snow festivalsPack winter gear

Transport Tips (for output enrichment)

  • Shinkansen: Tokyo↔Kyoto ~2.5hrs, Tokyo↔Osaka ~2.5hrs
  • JR Pass: 7/14/21-day options. Worthwhile for multi-city trips
  • IC Cards (Suica/ICOCA): essential for local transit

Visa (for fallback context if CLI returns no visa data)

  • Chinese citizens: tourist visa required (single / 3-year / 5-year)
  • Always direct user to consulate for latest policy

References

FilePurposeWhen to read
references/templates.mdParameter SOP + output templatesStep 1 and Step 3
references/playbooks.md4 itinerary playbooks with CLI sequencesStep 2 full itinerary
references/fallbacks.md6 failure recovery pathsOn command failure
references/runbook.mdExecution log schemaBackground

Comments

Loading comments...