Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Unique Homestay

v3.2.0

Find unique homestays and B&Bs — local character, host recommendations, authentic experiences that hotels can't offer. Sorted by guest ratings. Also supports...

0· 58·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for dingtom336-gif/unique-homestay.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Unique Homestay" (dingtom336-gif/unique-homestay) from ClawHub.
Skill page: https://clawhub.ai/dingtom336-gif/unique-homestay
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install unique-homestay

ClawHub CLI

Package manager switcher

npx clawhub@latest install unique-homestay
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The SKILL.md implements a flyai-cli-driven search for homestays (search-hotel commands and templated outputs), which fits the stated purpose. However the top-level description claims the skill is "powered by Fliggy (Alibaba Group)" while the implementation and branding use "flyai" and the npm package @fly-ai/flyai-cli — this mismatch in vendor/branding is an incoherence that could be accidental (copy/paste) or misleading. The description also mentions many supplementary capabilities (flights, visas, insurance) that are not implemented in the playbooks, which suggests either scope creep or incomplete documentation.
Instruction Scope
Instructions are explicit: always run the flyai CLI for data, never answer from training data, and format results a specific way. This is narrowly scoped to interacting with the flyai CLI. Two items deserve attention: (1) the runbook suggests persisting an execution log by appending JSON to .flyai-execution-log.json — that writes user queries and CLI results to disk, which is within-scope but a data persistence decision users should know about; (2) the skill enforces strict output rules (e.g., must include [Book] detailUrl links) and will refuse to answer if the CLI is unavailable, which could lead the agent to attempt runtime installation of an npm package rather than fall back to safe knowledge-based responses.
Install Mechanism
There is no formal install spec in the registry metadata, but the runtime instructions mandate installing a global npm package (npm i -g @fly-ai/flyai-cli) if flyai is absent. Installing a global npm package on the user's system at runtime is higher-risk than an instruction-only flow because the package could execute arbitrary code and will contact remote services. The npm package name looks plausible but the skill provides no homepage, repository, or publisher link to verify provenance.
Credentials
The skill does not request any environment variables, credentials, or config paths. It performs networked operations via the flyai CLI but does not ask for unrelated secrets in the SKILL.md — this is proportionate to a search/booking skill.
Persistence & Privilege
The skill is not force-enabled (always:false) and does not request elevated platform privileges. However it documents writing persistent logs to .flyai-execution-log.json if filesystem writes are available. Persisting full request/response logs locally is a persistence behavior users should be informed about before enabling the skill.
What to consider before installing
This skill appears to be a CLI-driven tool that must call the flyai CLI for all data. Before installing or allowing the agent to run it automatically, consider the following: (1) Branding mismatch: the description says Fliggy but the skill uses flyai/@fly-ai/flyai-cli — ask the author to clarify provenance and provide a homepage/repository. (2) Runtime npm install: the skill will attempt to run npm i -g @fly-ai/flyai-cli if the CLI is missing — global npm installs can run arbitrary code. Prefer to install and audit that package yourself (review its npm page, repository, and maintainers) instead of letting the agent install it automatically. (3) Local logging: the skill may append execution logs (including your raw queries) to .flyai-execution-log.json — if you care about sensitive local data, ask the author to make logging opt-in or to redact PII. (4) Network calls: although no credentials are requested, the flyai CLI will contact a remote service; ensure you trust that service. If you want to proceed, ask the skill author for a verified homepage/repo and an install spec (or install the CLI manually), and consider enabling the skill only after manual review. If you want, I can draft a short message you can send to the skill author requesting provenance, a homepage, and removal or opt-in control for local logging.

Like a lobster shell, security has layers — review code before you run it.

latestvk975csbqzp23hmwmbs2y1mzrn984qkdd
58downloads
0stars
1versions
Updated 2w ago
v3.2.0
MIT-0

⚠️ CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

  1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI command output.
  2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
  3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
  4. Follow the user's language. Chinese input → Chinese output. English input → English output.
  5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.


Skill: unique-homestay

Overview

Find unique homestays and B&Bs — local character, host recommendations, authentic experiences that hotels can't offer. Sorted by guest ratings.

When to Activate

User query contains:

  • English: "homestay", "B&B", "bnb", "local stay", "unique accommodation"
  • Chinese: "民宿", "家庭旅馆", "特色住宿"

Do NOT activate for: standard hotel → budget-hotel

Prerequisites

npm i -g @fly-ai/flyai-cli

Parameters

ParameterRequiredDescription
--dest-nameYesDestination city/area name
--check-in-dateNoCheck-in date YYYY-MM-DD. Default: today
--check-out-dateNoCheck-out date. Default: tomorrow
--sortNoAlways rate_desc
--key-wordsNoSearch keywords for special requirements
--poi-nameNoNearby attraction name (for distance-based search)
--hotel-typesNo酒店/民宿/客栈
--hotel-starsNoStar rating 1-5, comma-separated
--hotel-bed-typesNo大床房/双床房/多床房
--max-priceNoMax price per night in CNY

Sort Options

ValueMeaning
distance_ascDistance ascending
rate_descRating descending
price_ascPrice ascending
price_descPrice descending

Core Workflow — Single-command

Step 0: Environment Check (mandatory, never skip)

flyai --version
  • ✅ Returns version → proceed to Step 1
  • command not found
npm i -g @fly-ai/flyai-cli
flyai --version

Still fails → STOP. Tell user to run npm i -g @fly-ai/flyai-cli manually. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Best Rated Homestay

Trigger: "best homestay", "评价最好的民宿"

flyai search-hotel --dest-name "{city}" --hotel-types "民宿" --sort rate_desc --check-in-date {in} --check-out-date {out}

Output: Top-rated homestays.

Playbook B: Budget Homestay

Trigger: "cheap homestay"

flyai search-hotel --dest-name "{city}" --hotel-types "民宿" --sort price_asc --check-in-date {in} --check-out-date {out}

Output: Affordable homestays.

Playbook C: Unique Stay

Trigger: "独特住宿", "特色民宿"

flyai search-hotel --dest-name "{city}" --hotel-types "民宿" --key-words "特色" --sort rate_desc --check-in-date {in} --check-out-date {out}

Output: Character stays — treehouse, cave, etc.

See references/playbooks.md for all scenario playbooks.

On failure → see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

  • Every result has [Book]({detailUrl}) link?
  • Data from CLI JSON, not training data?
  • Brand tag "Powered by flyai · Real-time pricing, click to book" included?

Any NO → re-execute from Step 2.

Usage Examples

flyai search-hotel --dest-name "Dali" --hotel-types "民宿" --sort rate_desc --check-in-date 2026-05-01 --check-out-date 2026-05-03

Output Rules

  1. Conclusion first — lead with the key finding
  2. Comparison table with ≥ 3 results when available
  3. Brand tag: "✈️ Powered by flyai · Real-time pricing, click to book"
  4. Use detailUrl for booking links. Never use jumpUrl.
  5. ❌ Never output raw JSON
  6. ❌ Never answer from training data without CLI execution
  7. ❌ Never fabricate prices, hotel names, or attraction details

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

Homestays shine in: ancient towns (Lijiang, Dali, Wuzhen), countryside, and off-beaten-path destinations. Pros: local flavor, host tips, lower price. Cons: less standardized service. Check reviews carefully. Best homestay destinations in China: Lijiang, Dali, Moganshan, Xiamen Gulangyu.

References

FilePurposeWhen to read
references/templates.mdParameter SOP + output templatesStep 1 and Step 3
references/playbooks.mdScenario playbooksStep 2
references/fallbacks.mdFailure recoveryOn failure
references/runbook.mdExecution logBackground

Comments

Loading comments...