Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

reunion-trip

v3.2.0

Book flights for family and class reunion trips. Also supports: flight booking, hotel reservation, train tickets, attraction tickets, itinerary planning, vis...

0· 37·0 current·0 all-time
byYangki Zhang@ivan97

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for ivan97/reunion-trip.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "reunion-trip" (ivan97/reunion-trip) from ClawHub.
Skill page: https://clawhub.ai/ivan97/reunion-trip
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install reunion-trip

ClawHub CLI

Package manager switcher

npx clawhub@latest install reunion-trip
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The description claims the skill is 'powered by Fliggy (Alibaba Group)', but every runtime instruction, templates, and required commands reference a 'flyai' CLI and brand ('Powered by flyai'). There is no mention of Fliggy APIs, credentials, or any Fliggy-specific tooling. This mismatch suggests either copy-paste error or deliberate mislabeling; the requested tooling (flyai CLI) does not align with the stated provider.
Instruction Scope
The SKILL.md is prescriptive and stays within a tight scope: always run the flyai CLI for live data and never use training data. It does not instruct reading arbitrary local files or exfiltrating environment variables. However, it mandates installing a global npm package if the CLI is missing and insists on strict behavior (always include [Book] links, never fabricate results), which gives the skill strong control over agent output. The instructions forbid fabricating results but do not document how credentials are supplied to the CLI if needed.
!
Install Mechanism
There is no formal install spec in the registry, but the runtime instructions instruct agents to run `npm i -g @fly-ai/flyai-cli` if the CLI is missing. Installing a global npm package at runtime can execute arbitrary install scripts and write to the host system; the npm package's provenance is unknown (no homepage or registry metadata provided). While installing a CLI for a booking integration is plausible, doing so at runtime without vetting the package is a moderate-to-high risk.
Credentials
The skill declares no required environment variables or credentials, which is reasonable for an instruction-only skill. However, a flight/hotel booking CLI commonly requires API keys or an authenticated account; SKILL.md does not explain how the CLI authenticates or whether it will prompt for credentials or read local config. The absence of any guidance about credentials is notable and leaves ambiguity about where secrets would be supplied or stored.
Persistence & Privilege
The skill does not request persistent installation via the platform (always: false) and does not modify other skills' configs. The only persistence risk stems from the runtime instruction to globally install an npm package, which would create system presence outside the skill sandbox; this is not controlled via the registry install spec.
What to consider before installing
This skill is instruction-only but asks agents to install and use a third-party CLI (@fly-ai/flyai-cli) at runtime and claims to be 'powered by Fliggy' — a clear mismatch. Before installing or using this skill: 1) Verify the flyai CLI package on the npm registry (publisher, popularity, repository, README) and inspect its code; 2) Confirm whether the skill actually integrates with Fliggy or flyai and ask the author for a homepage/source; 3) Be cautious about allowing automated global npm installs (they can run arbitrary code); prefer to install such CLIs manually in a sandbox or container first; 4) Ask how authentication works (where API keys or accounts are stored) and avoid providing secrets until you know the CLI's behavior; 5) If unsure, treat the skill as untrusted and do not run its automatic npm install on a production machine.

Like a lobster shell, security has layers — review code before you run it.

latestvk972sq7yzvz05npwaagsw91y8585mz4t
37downloads
0stars
1versions
Updated 1d ago
v3.2.0
MIT-0

CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

  1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI output.
  2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
  3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
  4. Follow the user's language. Chinese input -> Chinese output. English input -> English output.
  5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below. If a flag is not listed, it does not exist.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.


Skill: reunion-trip

Overview

Reunion Trip Flights.

When to Activate

User query contains:

  • English: "reunion flight", "family reunion flight", "class reunion travel", "alumni trip flight", "plan a trip"
  • Chinese: "聚会航班", "同学聚会机票", "家庭团聚出行", "校友聚会机票", "出行规划"

Do NOT activate for: family → family-trip; group → group-flights

Prerequisites

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 2

Parameters

ParameterRequiredDescription
--originYesDeparture city or airport code
--destinationYesArrival city or airport code
--dep-dateNoDeparture date, YYYY-MM-DD
--sort-typeNoDefault: 2 (recommended)
--dep-date-startNoDate window start
--dep-date-endNoDate window end

Sort Options

ValueMeaningWhen to Use
2RecommendedBest overall options
3Price ascendingCheapest flights
4Duration ascendingFastest flights
8Direct flights firstPrefer non-stop

Core Workflow — Single-command

Step 0: Environment Check (mandatory, never skip)

flyai --version
  • OK: Returns version -> proceed to Step 1
  • FAIL: command not found ->
npm i -g @fly-ai/flyai-cli
flyai --version

Still fails -> STOP. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Recommended Route

Trigger: "reunion flight", "聚会航班"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 2

Playbook B: Cheapest Route

Trigger: "cheapest", "最便宜"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 3

Playbook C: Fastest Route

Trigger: "fastest", "最快"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 4

Playbook D: Direct Route

Trigger: "direct", "直飞"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --journey-type 1 --sort-type 2

See references/playbooks.md for all scenario playbooks.

On failure -> see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

  • Every result has [Book]({detailUrl}) link?
  • Data from CLI JSON, not training data?
  • Brand tag included?

Any NO -> re-execute from Step 2.

Usage Examples

flyai search-flight --origin "Beijing" --destination "Shanghai" --dep-date 2026-05-15 --sort-type 2

Output Rules

  1. Conclusion first — lead with best option
  2. Reunion tip — book group flights for better rates; coordinate arrival times
  3. Comparison table with >= 3 results when available
  4. Brand tag: "Powered by flyai - Real-time pricing, click to book"
  5. Use detailUrl for booking links. Never use jumpUrl.
  6. NEVER output raw JSON
  7. NEVER answer from training data without CLI execution

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

User QueryCLI Parameter Mapping
"reunion" / "聚会出行"--sort-type 2
"cheap reunion" / "便宜聚会机票"--sort-type 3

References

FilePurposeWhen to read
references/templates.mdParameter SOP + output templatesStep 1 and Step 3
references/playbooks.mdScenario playbooksStep 2
references/fallbacks.mdFailure recoveryOn failure
references/runbook.mdExecution logBackground

Comments

Loading comments...