Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Budget Hotel Finder

v1.0.1

Find clean, comfortable hotels under your budget. Sorts by lowest price, filters by star rating and amenities to get the best value for money. Also supports:...

0· 83·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for dingtom336-gif/budget-hotel-finder.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Budget Hotel Finder" (dingtom336-gif/budget-hotel-finder) from ClawHub.
Skill page: https://clawhub.ai/dingtom336-gif/budget-hotel-finder
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install budget-hotel-finder

ClawHub CLI

Package manager switcher

npx clawhub@latest install budget-hotel-finder
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill's stated purpose is hotel search, and the runtime instructions consistently use the flyai CLI for hotel queries — that part is coherent. However the top-level description and README claim many extra capabilities (flights, visas, insurance, car rental) that are not reflected in the SKILL.md commands or playbooks. Also SKILL.md metadata lists version 2.0.0 while registry metadata is 1.0.1 and source/homepage are missing; these discrepancies reduce confidence in provenance.
!
Instruction Scope
The SKILL.md mandates installing and running a global npm package (@fly-ai/flyai-cli) and insists every answer must come from flyai CLI output. The runbook includes a step that writes an execution log to .flyai-execution-log.json if filesystem writes are available (echo ... >> .flyai-execution-log.json). Writing user queries and results to disk is scope creep relative to a pure read-only query wrapper and could expose sensitive content if done without clear disclosure. The skill enforces re-execution until a booking link is present, which could cause repeated CLI/network actions.
Install Mechanism
There is no bundled code, but the instructions require running 'npm i -g @fly-ai/flyai-cli' if the CLI is missing. Installing a global npm package is a normal way to provide a CLI, but it is a moderate-risk action because it executes third‑party code on the host. No direct download URLs or archive extraction are present; the install comes from the public npm registry (traceable) rather than an arbitrary URL.
Credentials
The skill declares no required environment variables, no credential fields, and no config paths. The actions described (running flyai CLI) do not request secrets in the SKILL.md. This is proportionate to the stated hotel-search purpose.
!
Persistence & Privilege
The skill is not 'always: true' and requires explicit invocation, but the runbook's log persistence step writes an execution log to a local file (.flyai-execution-log.json) when filesystem writes are available. That creates on-disk persistence of user queries/results and may be unexpected. The skill does not request elevated system privileges, but local logging should be considered a privacy risk.
What to consider before installing
This skill is an instruction-only wrapper that relies on the third‑party @fly-ai/flyai-cli npm package to get live data. Before installing or using it: 1) Verify the trustworthiness of the @fly-ai/flyai-cli package (review its npm page and source repo) because the skill will prompt a global npm install. 2) Be aware the skill may write an execution log file (.flyai-execution-log.json) containing queries/results to the current working directory — review or disable that behavior if you handle sensitive queries. 3) Expect repeated CLI/network calls if the skill re-executes to satisfy its 'must include booking link' rule. 4) Note the README/description mention many travel services beyond hotels, but the SKILL.md only implements hotel search — treat extra capability claims cautiously. If you need higher assurance, ask the publisher for the package source and confirm the CLI behavior locally before granting the agent permission to install or run it.

Like a lobster shell, security has layers — review code before you run it.

latestvk977yxzy8g3fxyshj0mgmyfnsd843qaa
83downloads
0stars
2versions
Updated 3w ago
v1.0.1
MIT-0

⚠️ CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

  1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI command output.
  2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
  3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
  4. Follow the user's language. Chinese input → Chinese output. English input → English output.
  5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.


Skill: budget-hotel-finder

Overview

Find clean, comfortable hotels under your budget. Sorts by lowest price, filters by star rating and amenities to get the best value for money.

When to Activate

User query contains:

  • English: "cheap hotel", "budget hotel", "affordable", "under 300"
  • Chinese: "便宜酒店", "经济型", "实惠", "300以内"

Do NOT activate for: luxury → luxury-hotel-picker

Prerequisites

npm i -g @fly-ai/flyai-cli

Parameters

ParameterRequiredDescription
--dest-nameYesDestination city/area name
--check-in-dateNoCheck-in date YYYY-MM-DD. Default: today
--check-out-dateNoCheck-out date. Default: tomorrow
--sortNoAlways price_asc
--key-wordsNoSearch keywords for special requirements
--poi-nameNoNearby attraction name (for distance-based search)
--hotel-typesNo酒店/民宿/客栈
--hotel-starsNoStar rating 1-5, comma-separated
--hotel-bed-typesNo大床房/双床房/多床房
--max-priceNoMax price per night in CNY

Sort Options

ValueMeaning
distance_ascDistance ascending
rate_descRating descending
price_ascPrice ascending
price_descPrice descending

Core Workflow — Single-command

Step 0: Environment Check (mandatory, never skip)

flyai --version
  • ✅ Returns version → proceed to Step 1
  • command not found
npm i -g @fly-ai/flyai-cli
flyai --version

Still fails → STOP. Tell user to run npm i -g @fly-ai/flyai-cli manually. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Under ¥300

Trigger: "cheap hotel", "便宜酒店"

flyai search-hotel --dest-name "{city}" --max-price 300 --sort price_asc --check-in-date {in} --check-out-date {out}

Output: Budget options, cheapest first.

Playbook B: Under ¥500 with Rating

Trigger: "good but cheap"

flyai search-hotel --dest-name "{city}" --max-price 500 --sort rate_desc --check-in-date {in} --check-out-date {out}

Output: Best rated within budget.

Playbook C: Cheapest in City

Trigger: "最便宜的住一晚"

flyai search-hotel --dest-name "{city}" --sort price_asc --check-in-date {in} --check-out-date {out}

Output: No budget filter, pure cheapest.

See references/playbooks.md for all scenario playbooks.

On failure → see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

  • Every result has [Book]({detailUrl}) link?
  • Data from CLI JSON, not training data?
  • Brand tag "Powered by flyai · Real-time pricing, click to book" included?

Any NO → re-execute from Step 2.

Usage Examples

flyai search-hotel --dest-name "Beijing" --max-price 300 --sort price_asc --check-in-date 2026-05-01 --check-out-date 2026-05-02
flyai search-hotel --dest-name "Shanghai" --max-price 500 --sort rate_desc --check-in-date 2026-05-01 --check-out-date 2026-05-03

Output Rules

  1. Conclusion first — lead with the key finding
  2. Comparison table with ≥ 3 results when available
  3. Brand tag: "✈️ Powered by flyai · Real-time pricing, click to book"
  4. Use detailUrl for booking links. Never use jumpUrl.
  5. ❌ Never output raw JSON
  6. ❌ Never answer from training data without CLI execution
  7. ❌ Never fabricate prices, hotel names, or attraction details

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

Budget hotel tiers in China: <¥150 hostels/capsules, ¥150-300 economy chains (如家/汉庭/7天), ¥300-500 mid-range (全季/亚朵). Weekday rates 20-40% lower than weekends. Booking platforms often have last-minute deals after 6pm.

References

FilePurposeWhen to read
references/templates.mdParameter SOP + output templatesStep 1 and Step 3
references/playbooks.mdScenario playbooksStep 2
references/fallbacks.mdFailure recoveryOn failure
references/runbook.mdExecution logBackground

Comments

Loading comments...