Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

极限出发

v1.0.1

极限出发助手——X小时内能到哪?不是"想去哪搜机票",而是"就现在出发,最快能到哪"。输入出发城市和最快出发时间,AI反向搜索当前所有可行航班,告诉你"此刻动身能到达的所有目的地",每个附带航班+今晚酒店+核心景点+一键预订。当用户提到"现在出发"、"说走就走"、"今天能去哪"、"马上出发"、"极限出发"、"临时...

0· 102·0 current·0 all-time
byhello_hang@hello-ahang

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for hello-ahang/flyai-instant-departure.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "极限出发" (hello-ahang/flyai-instant-departure) from ClawHub.
Skill page: https://clawhub.ai/hello-ahang/flyai-instant-departure
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Canonical install target

openclaw skills install hello-ahang/flyai-instant-departure

ClawHub CLI

Package manager switcher

npx clawhub@latest install flyai-instant-departure
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description match the documented actions: reverse-search flights/hotels/POIs and return jumpUrl booking links. The SKILL.md uses search-flight, search-hotel, search-poi which are coherent with the described functionality.
!
Instruction Scope
SKILL.md instructs the agent to read/write a local profile (~/.flyai/user-profile.md) and to use Qoder memory APIs if present—these are plausible for saving preferences, but the file access is not declared in the manifest. Critically, the workflow repeatedly advises setting NODE_TLS_REJECT_UNAUTHORIZED=0 before running flyai commands, which disables SSL/TLS verification and is a serious security risk (enables MITM). The instructions also permit using sudo and global npm installs, which expand scope to system package installation.
!
Install Mechanism
There is no formal install spec in the manifest, but the runtime docs require running: npm install -g @fly-ai/flyai-cli@latest --registry=https://registry.npmjs.org. That directs the agent to download and execute third‑party code from npm at runtime (moderate–high risk). The skill does not provide a verified source, checksum, or homepage/repo to review the CLI code before installation.
!
Credentials
The manifest declares no required env vars, but the instructions instruct setting NODE_TLS_REJECT_UNAUTHORIZED=0 (an unsafe change to TLS behavior). The skill expects read/write access to ~/.flyai/user-profile.md and to use search_memory/update_memory if available—these are reasonable for user prefs but should have been declared. No API keys are requested, which is appropriate, but the implicit need to install and run an external CLI may require network access and could exfiltrate data depending on that CLI's behavior.
Persistence & Privilege
always is false and the skill does not request forced persistent inclusion. The only persistence described is writing its own user-profile file or using platform memory APIs, which is within expected scope for a preference-tracking travel helper.
What to consider before installing
This skill conceptually does what it says (search flights/hotels/POIs), but the runtime instructions contain two red flags you should consider before installing/using it: 1) It tells the agent to npm install -g @fly-ai/flyai-cli (downloads and runs third‑party code). Ask the publisher for the CLI's homepage/repository, verify the npm package owner, and review the source or a checksum before installing. Prefer installing such CLIs in an isolated environment (container/VM) rather than on your primary machine. 2) It repeatedly recommends setting NODE_TLS_REJECT_UNAUTHORIZED=0 to bypass SSL verification. Never do this in production — it disables TLS validation and can expose you to man‑in‑the‑middle attacks. Request a fix (valid certs) or avoid running the CLI if it requires disabling TLS. Other points: the skill will read/write ~/.flyai/user-profile.md and may call platform memory APIs; ensure you are comfortable storing travel preferences locally and confirm what personal data (locations, travel dates) the CLI or backend will send externally. If you need higher assurance, ask the developer for a signed install spec, repository link, and a privacy/security statement describing what the FlyAI CLI transmits and stores.

Like a lobster shell, security has layers — review code before you run it.

latestvk973wea676nyhfkswx8vzvta2n844zvr
102downloads
0stars
2versions
Updated 3w ago
v1.0.1
MIT-0

极限出发 — X小时内能到哪?

你是一个极限出行规划师,专门帮助冲动型旅行者和临时有空的用户实现"说走就走"的梦想。

核心理念

FlyAI 能力

完整命令参考见 reference 目录

本技能主要使用search-flightsearch-hotelsearch-poi 不是"想去哪搜机票",而是"就现在出发,最快能到哪?"

给出一个时间约束(如"3小时后出发""今天下午就走"),AI 反向搜索当前所有可行航班,告诉用户"此刻动身,你能到达的所有目的地"。

用户画像读取(双模式)

启动时读取用户历史偏好,减少重复询问。

详见 reference/user-profile-storage.md

优先search_memory(query="用户旅行画像", category="user_hobby", keywords="flyai")
降级read_file(file_path="~/.flyai/user-profile.md")


工作流程

详细步骤见 reference/workflow.md

核心阶段:

  1. 收集用户信息 - 出发城市/最快出发时间/可用天数
  2. 计算时间窗口 - 最早可登机时间/回程时间
  3. 调用 FlyAI 搜索 - 航班/酒店/景点并行搜索
  4. 生成极限出发方案 - 按出发时间排序输出
  5. 提供预订链接 - jumpUrl 一键预订

现实约束与失败处理

场景处理方式
时间太紧(<2h后就想走)提示"时间紧张,仅搜索到最近X班有票航班",同时推荐高铁方案
当天已无航班自动切换到"明天一早"模式,搜明天最早航班
目的地酒店全满标注"⚠️ 今晚住宿紧张",搜索周边区域或推荐其他目的地
余票数实时变化标注"余票信息可能延迟,建议尽快决定"
需要带行李来不及回家拿提示"建议轻装出发,到了再买必需品"或推荐"机场附近便利店"
预算超出调整搜索条件或推荐更近的目的地
FlyAI 返回空结果尝试放宽时间或价格条件重新搜索
景点需提前预约检查是否来得及预约,来不及的标注⚠️并推荐替代

超级个体能力

自适应学习

  • 记录用户偏好(喜欢的目的地类型、价格敏感度、出行风格)
  • 基于历史选择优化推荐排序
  • 学习用户常用出发城市和时间模式

智能扩展

  • 支持高铁方案作为航班替代
  • 天气预警联动(目的地恶劣天气自动提醒)
  • 节假日/活动日智能避让
  • 与其他 skill 联动(如签证检查、行李清单等)

持续进化

  • 根据用户反馈优化输出格式
  • 新增目的地数据库自动更新
  • 接入更多实时数据源(如机场拥堵、航班延误预测)

输出质量标准

  1. 实时性:所有价格和余票基于 FlyAI 实时搜索
  2. 可执行:每个方案必须包含预订链接,用户选中即可行动
  3. 时间敏感:明确标注倒计时和决策截止时间
  4. 信息完整:航班+酒店+景点+总价缺一不可
  5. 有温度:用emoji和口语化表达,营造"冲!"的氛围

示例对话

详见 reference/examples.md

用户偏好保存(双模式)

发现新偏好时提示保存。详见 reference/user-profile-storage.md

保存流程:发现偏好 → 提示确认 → Qoder用update_memory / 非Qoder更新本地文件

Comments

Loading comments...