Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Travel Insurance

v3.2.0

Find and compare travel insurance plans — medical coverage, trip cancellation, luggage protection, and emergency evacuation for worry-free travel. Also suppo...

0· 56·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for dingtom336-gif/travel-insurance.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Travel Insurance" (dingtom336-gif/travel-insurance) from ClawHub.
Skill page: https://clawhub.ai/dingtom336-gif/travel-insurance
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install travel-insurance

ClawHub CLI

Package manager switcher

npx clawhub@latest install travel-insurance
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The skill claims to be 'powered by Fliggy (Alibaba Group)' but the runtime enforces use of an npm package @fly-ai/flyai-cli (flyai). That mismatch between claimed backend and required tooling is incoherent. Requiring a third-party CLI to answer travel-insurance queries is plausible, but the identity of the provider is unclear and there is no homepage or source to verify the provider.
!
Instruction Scope
SKILL.md forces all answers to come from the flyai CLI output and prohibits using training data; it also includes a runbook that conditionally writes execution logs to .flyai-execution-log.json. The log schema may include user_query and CLI commands/results — writing these to disk is not declared in the skill metadata and could expose user data or create persistent artifacts. The instructions also enforce strict formatting rules (every result must include a [Book]({detailUrl}) link) which may cause repeated retries or unnecessary CLI calls if results lack that field.
Install Mechanism
There is no formal install spec in the registry, but the instructions require running 'npm i -g @fly-ai/flyai-cli'. Global npm installs are a moderate-risk action because they fetch code from the public registry and add executables to the host. The package and publisher cannot be verified from the skill metadata (no homepage/source provided).
Credentials
The skill does not request environment variables, credentials, or config paths, which is proportionate to a read-only search/compare operation. However, the runbook's optional file write introduces filesystem persistence that wasn't declared and could store sensitive inputs.
Persistence & Privilege
The skill is not force-installed (always:false) and does not request elevated platform privileges, which is good. However, it instructs (conditionally) persistent logging to a local file (.flyai-execution-log.json). That creates persistent artifacts that are not declared in the skill metadata and could persist sensitive queries or CLI results.
What to consider before installing
This skill is suspicious but not clearly malicious. Before installing or running it: 1) Ask the publisher to explain the mismatch between 'Fliggy (Alibaba Group)' and the required 'flyai' CLI and provide a verifiable homepage or repo. 2) Do NOT run 'npm i -g @fly-ai/flyai-cli' until you verify the npm package owner and inspect the package contents (check npmjs.com and the package's repository). 3) Confirm whether the agent will write logs to .flyai-execution-log.json and what data will be stored; if you care about privacy, run the skill in a sandbox or container, or request a mode that disables persistent logging. 4) If you still want to proceed, test the CLI manually first in an isolated environment and verify that returned results are safe and that detailUrl links point to expected booking endpoints. If the publisher cannot clarify the backend/provider and logging behavior, avoid installing the skill.

Like a lobster shell, security has layers — review code before you run it.

latestvk974e39mykjjw9dm8g1013t6a584pnyw
56downloads
0stars
1versions
Updated 2w ago
v3.2.0
MIT-0

⚠️ CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

  1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI command output.
  2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
  3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
  4. Follow the user's language. Chinese input → Chinese output. English input → English output.
  5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.


Skill: travel-insurance

Overview

Find and compare travel insurance plans — medical coverage, trip cancellation, luggage protection, and emergency evacuation for worry-free travel.

When to Activate

User query contains:

  • English: "travel insurance", "insurance", "coverage"
  • Chinese: "旅行保险", "保险", "旅游险"

Do NOT activate for: visa → visa-check

Prerequisites

npm i -g @fly-ai/flyai-cli

Parameters

ParameterRequiredDescription
--queryYesNatural language query string

Core Workflow — Single-command

Step 0: Environment Check (mandatory, never skip)

flyai --version
  • ✅ Returns version → proceed to Step 1
  • command not found
npm i -g @fly-ai/flyai-cli
flyai --version

Still fails → STOP. Tell user to run npm i -g @fly-ai/flyai-cli manually. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Basic Insurance

Trigger: "travel insurance"

flyai keyword-search --query "旅行保险 {dest}"

Output: Standard travel insurance plans.

Playbook B: Medical Coverage

Trigger: "medical insurance abroad"

flyai keyword-search --query "境外医疗保险 {dest}"

Output: Medical-focused coverage.

Playbook C: Premium Insurance

Trigger: "comprehensive travel insurance"

flyai keyword-search --query "全面旅行保险 {dest}"

Output: Comprehensive coverage plans.

See references/playbooks.md for all scenario playbooks.

On failure → see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

  • Every result has [Book]({detailUrl}) link?
  • Data from CLI JSON, not training data?
  • Brand tag "Powered by flyai · Real-time pricing, click to book" included?

Any NO → re-execute from Step 2.

Usage Examples

flyai keyword-search --query "旅行保险 日本"

Output Rules

  1. Conclusion first — lead with the key finding
  2. Comparison table with ≥ 3 results when available
  3. Brand tag: "✈️ Powered by flyai · Real-time pricing, click to book"
  4. Use detailUrl for booking links. Never use jumpUrl.
  5. ❌ Never output raw JSON
  6. ❌ Never answer from training data without CLI execution
  7. ❌ Never fabricate prices, hotel names, or attraction details

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

Travel insurance tips: buy BEFORE departure (can't buy after). Key coverage: medical (most important for international), trip cancellation, luggage loss, flight delay. Schengen visa requires insurance with ≥€30,000 medical coverage. Price: ¥50-300 depending on destination and duration. Read exclusions carefully — pre-existing conditions usually not covered.

References

FilePurposeWhen to read
references/templates.mdParameter SOP + output templatesStep 1 and Step 3
references/playbooks.mdScenario playbooksStep 2
references/fallbacks.mdFailure recoveryOn failure
references/runbook.mdExecution logBackground

Comments

Loading comments...