FlyWise — Student Flight Price API (留学生机票实时查询)
PassAudited by ClawScan on May 6, 2026.
Overview
The skill is a coherent paid flight-price lookup workflow, with the main user-noticeable risks being the small per-query payment and sharing flight/payment data with external services.
Use this skill only if you are comfortable sharing your route/date search with flywise.win and completing a 0.03 yuan per-query payment through the payment skill. Confirm each charge, keep the Payment-Proof private, and use the free browser option mentioned in the skill if you do not want the paid flow.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A user may be asked to pay a small fee before receiving flight results.
The skill chains an external flight API request into a payment-service workflow. This is disclosed and purpose-aligned, but it is still a paid action.
把整个 402 响应报文...传递给支付宝的 alipay-pay-for-402-service 技能，引导用户完成付款（每次 0.03 元，单次扣款，无订阅）。
Confirm the user understands and approves each paid query, and avoid automatic retries that could create repeated payment prompts.
If the payment proof is exposed, someone else might be able to use that paid request or inspect payment-related metadata.
The Payment-Proof acts like a temporary credential authorizing the paid API result.
用户付款成功后会得到 `Payment-Proof` 凭证。将该凭证作为 HTTP Header 携带
Use the Payment-Proof only for the exact paid request, do not paste it elsewhere, and avoid verbose logging or displaying the header unnecessarily.
Users must trust the remote flywise.win service behavior because no server-side implementation is included for review.
The artifacts identify the service domain, but do not provide source-code provenance or a homepage for independent review.
Source: unknown; Homepage: none
Treat flywise.win as a third-party paid service and verify the domain and payment amount before using it.
Flight-search and payment-challenge details may be shared with the payment skill as part of completing the transaction.
The workflow passes a full payment challenge response from one service to another skill, creating an inter-service data flow.
把整个 402 响应报文（包括响应头与响应体）传递给支付宝的 alipay-pay-for-402-service 技能
Only pass the payment challenge needed for the transaction, and do not include unrelated user data in the request.