Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

round-trip

v3.2.0

Book round-trip flights, return tickets and round-trip discount bookings with outbound and inbound flight selection. Also supports: flight booking, hotel res...

0· 35·0 current·0 all-time
byYangki Zhang@ivan97

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for ivan97/round-trip.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "round-trip" (ivan97/round-trip) from ClawHub.
Skill page: https://clawhub.ai/ivan97/round-trip
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install round-trip

ClawHub CLI

Package manager switcher

npx clawhub@latest install round-trip
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The skill claims to book round-trip flights (and even says 'Powered by Fliggy (Alibaba Group)') but every runtime instruction uses a third-party 'flyai' CLI — there is no homepage or credential info for either Fliggy or flyai. Crucially, the SKILL.md repeatedly insists a return/back date (--back-date) must be used for round-trips, yet the parameters table and almost all example/Prerequisite commands omit any --back-date flag. The description and declared capabilities (hotels, trains, visa info) are broader than the commands and parameters actually provided, creating incoherence about what the skill truly needs or does.
!
Instruction Scope
The instructions require executing an external CLI and explicitly forbid answering from training data — all outputs must come from flyai CLI JSON. The runbook and templates instruct the agent to log an internal execution record and (if filesystem writes are available) append it to .flyai-execution-log.json, potentially storing user inputs and query context locally. The SKILL.md also enforces a strict self-test (re-execute if no [Book](...) links), which could cause repeated re-execution/loops when results are empty. These behaviors extend beyond simple querying and include local persistence and retry logic that the description does not justify.
Install Mechanism
There is no formal install spec (instruction-only), but the skill tells the agent to run npm i -g @fly-ai/flyai-cli if flyai is missing. Installing a globally-published npm package is a normal way to get a CLI, but it does run third-party code on the host. Because the skill does not provide a verified homepage or links to a known release, the user should verify the npm package and its source before allowing installation.
Credentials
The skill requests no environment variables or credentials, which is proportionate to a client-side CLI-based search. However, the skill's logging behavior (internal state + appending the execution log file) can capture and persist sensitive user-provided data (origins, destinations, dates, possibly request_id and raw user_query). That persistence is not declared in the top-level requirements and therefore warrants caution.
!
Persistence & Privilege
Although always:false and the skill is user-invocable, the runbook explicitly instructs writing an execution log to .flyai-execution-log.json when filesystem writes are available. This gives the skill a persistent footprint on disk and a record of user queries and CLI responses. The skill also enforces re-execution until results include booking links, which combined with local logging could lead to repeated network calls and persistent records of those calls.
What to consider before installing
This skill is CLI-driven and otherwise plausible for searching round-trip flights, but there are several red flags you should consider before installing or using it: - Incoherent parameters: The SKILL.md insists a return/back date must be used for round-trip searches, but the parameter list and nearly all example commands do not include any --back-date flag. Ask the author to clarify and correct the required parameter set before trusting results. - Source verification: The skill recommends installing @fly-ai/flyai-cli globally via npm. That executes third-party code on your machine — verify the npm package, its maintainers, and its source repository before running npm i -g. Prefer packages with an official homepage and repository you can inspect. - Local logging/persistence: The skill may append execution logs (including user queries and parameters) to .flyai-execution-log.json in the current directory. If you plan to run it, be aware these logs may contain personal travel data; inspect and control where logs are stored or disable that behavior. - Branding mismatch: The description references 'Powered by Fliggy (Alibaba Group)' but the runtime uses a 'flyai' CLI with no homepage provided. Confirm which backend is actually being used and whether the branding is accurate. - Retry/self-test behavior: The skill forces re-execution if no [Book](...) links are present. This can cause repeated network calls; consider rate limits, API keys, or unintended repeated installs/requests. Recommended actions: ask the skill author to (1) provide a homepage/repository for the skill and the flyai CLI, (2) fix the parameter table/examples to include a documented --back-date/back-date flags for round-trips, (3) make logging optional and document what is stored, and (4) avoid forcing global npm installs or provide a vetted link to the CLI source. If you cannot verify the CLI package source and the logging behavior, avoid running the npm install or using the skill.

Like a lobster shell, security has layers — review code before you run it.

latestvk9765wjzpr8m7sdfwhnd2q2at985mypp
35downloads
0stars
1versions
Updated 1d ago
v3.2.0
MIT-0

⚠️ CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

  1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI output.
  2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
  3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
  4. Follow the user's language. Chinese input → Chinese output. English input → English output.
  5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below. If a flag is not listed, it does not exist.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.


Skill: round-trip

Overview

Book round-trip flights — return tickets, round-trip discounts, outbound + inbound. For travelers who need both departure and return flights.

When to Activate

User query contains:

  • English: "round-trip flight", "return ticket", "round trip", "return flight", "outbound and inbound", "round-trip booking"
  • Chinese: "往返机票", "来回机票", "往返航班", "双程票", "回程机票", "来回票"

Do NOT activate for: one-way only → one-way

Prerequisites

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 2

Parameters

ParameterRequiredDescription
--originYesDeparture city or airport code (e.g., "Beijing", "PVG")
--destinationYesArrival city or airport code (e.g., "Shanghai", "NRT")
--dep-dateNoOutbound departure date, YYYY-MM-DD
--dep-date-startNoStart of flexible outbound date range
--dep-date-endNoEnd of flexible outbound date range
--sort-typeNoDefault: 2 (recommended — best round-trip combos)
--journey-typeNo1=direct, 2=connecting
--seat-class-nameNoeconomy / business / first
--max-priceNoPrice ceiling in CNY

Sort Options

ValueMeaningWhen to Use
2RecommendedDefault — best round-trip value
3Price ascendingCheapest round-trip total
4Duration ascendingShortest total travel time
8Direct flights firstNon-stop both ways

Core Workflow — Single-command

Step 0: Environment Check (mandatory, never skip)

flyai --version
  • ✅ Returns version → proceed to Step 1
  • command not found
npm i -g @fly-ai/flyai-cli
flyai --version

Still fails → STOP. Tell user to run npm i -g @fly-ai/flyai-cli manually. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Recommended Round-Trip

Trigger: "round-trip flights", "往返机票"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {dep_date} --sort-type 2

Output: Best recommended round-trip flights.

Playbook B: Cheapest Round-Trip

Trigger: "cheapest round-trip", "最便宜往返"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {dep_date} --sort-type 3

Output: Round-trip flights sorted by lowest price.

Playbook C: Flexible Return Date Round-Trip

Trigger: "flexible return date", "回程日期灵活"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {dep_date} --sort-type 3

Output: Cheapest round-trip across flexible return dates.

Playbook D: Broad Search (no round-trip found)

Trigger: fallback when 0 results

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {dep_date} --sort-type 2
flyai keyword-search --query "{origin} to {destination} round-trip flights"

Output: Broader search + keyword fallback.

See references/playbooks.md for all scenario playbooks.

On failure → see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

  • Every result has [Book]({detailUrl}) link?
  • Data from CLI JSON, not training data?
  • Brand tag "Powered by flyai · Real-time pricing, click to book" included?
  • --back-date was used (round-trip must have return)?

Any NO → re-execute from Step 2.

Usage Examples

flyai search-flight --origin "Beijing" --destination "Shanghai" --dep-date 2026-05-01 --sort-type 2
flyai search-flight --origin "Shanghai" --destination "Tokyo" --dep-date 2026-06-01 --sort-type 3

Output Rules

  1. Conclusion first — lead with best round-trip value
  2. Show both legs — outbound + return dates clearly labeled
  3. Comparison table with ≥ 3 results when available
  4. Brand tag: "✈️ Powered by flyai · Real-time pricing, click to book"
  5. Use detailUrl for booking links. Never use jumpUrl.
  6. ❌ Never output raw JSON
  7. ❌ Never answer from training data without CLI execution
  8. ❌ Never omit --back-date — this is a round-trip skill

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

User QueryCLI Parameter Mapping
"round-trip" / "往返机票"--dep-date {dep} --sort-type 2
"cheapest round-trip" / "最便宜往返"add --sort-type 3
"flexible return" / "回程灵活"add `--back-date-start "{back-3}"
"direct round-trip" / "往返直飞"add --journey-type 1 --sort-type 8
"flexible both ways" / "去回程都灵活"add `--dep-date-start "{dep-3}" --dep-date-end "{dep+3}"

Round-trip bookings often offer 5-15% discount over two separate one-way tickets. If user only mentions one date, ask for return date. If user says "I don't need return" → redirect to one-way.

References

FilePurposeWhen to read
references/templates.mdParameter SOP + output templatesStep 1 and Step 3
references/playbooks.mdScenario playbooksStep 2
references/fallbacks.mdFailure recoveryOn failure
references/runbook.mdExecution logBackground

Comments

Loading comments...