Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Budget Trip Planner

v1.0.1

Plan amazing trips on a tight budget — cheapest flights, budget hotels, free attractions, and money-saving hacks for every aspect of travel. Also supports: f...

0· 87·1 current·1 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for dingtom336-gif/budget-trip-planner.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Budget Trip Planner" (dingtom336-gif/budget-trip-planner) from ClawHub.
Skill page: https://clawhub.ai/dingtom336-gif/budget-trip-planner
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install budget-trip-planner

ClawHub CLI

Package manager switcher

npx clawhub@latest install budget-trip-planner
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description claim a budget trip planner and all runtime instructions consistently call the flyai CLI for flight/hotel/POI searches — the required capabilities align with the stated purpose. No unrelated credentials or binaries are requested.
Instruction Scope
SKILL.md strictly requires all data come from the flyai CLI and gives detailed command/parameter tables and output templates (coherent). However the runbook instructs the agent to create and persist an execution log that includes the raw user_query and steps; that introduces data retention of user inputs which is outside 'just querying a service' and should be considered scope creep/privacy-sensitive.
Install Mechanism
The skill is instruction-only (no install spec) but mandates installing an external npm package globally: npm i -g @fly-ai/flyai-cli. Installing a global npm CLI is a reasonable way to use a third-party service, but it is a supply-chain risk — the package will run code on the host and should be reviewed or installed in a sandbox.
Credentials
The skill requests no environment variables or credentials in metadata, which is proportionate. Still, the runbook log stores user_query and details of CLI calls; this is a data collection behavior not signaled by requires.env and should be considered when sharing sensitive queries.
!
Persistence & Privilege
always:false (good), but the runbook explicitly suggests appending an execution log to .flyai-execution-log.json if file writes are available. Persisting raw user queries and CLI commands on disk is a lasting data footprint and a privacy risk; this persistent behavior is not prominent in the high-level description and deserves user scrutiny.
What to consider before installing
This skill is essentially a wrapper around the third-party flyai CLI and behaves consistently with that purpose, but take two precautions before installing: 1) Review the @fly-ai/flyai-cli package yourself (source, maintainer, permissions) or run it in a restricted/sandboxed environment — global npm installs can run arbitrary code. 2) Be aware the skill's runbook suggests writing an execution log that includes your raw queries and CLI calls to .flyai-execution-log.json; if that persistence is unacceptable, do not install or ensure the agent cannot write files. Also note the SKILL.md version string differs from the registry version (minor metadata inconsistency). If you need higher assurance, ask the publisher for the flyai-cli source link or a signed release, and confirm whether flyai transmits booking/search data to third-party services (Fliggy/Alibaba) and what user data it collects.

Like a lobster shell, security has layers — review code before you run it.

latestvk979ms7w9bg53b8byfeqz3kphh8431f8
87downloads
0stars
2versions
Updated 3w ago
v1.0.1
MIT-0

⚠️ CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

  1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI command output.
  2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
  3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
  4. Follow the user's language. Chinese input → Chinese output. English input → English output.
  5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.


Skill: budget-trip-planner

Overview

Plan amazing trips on a tight budget — cheapest flights, budget hotels, free attractions, and money-saving hacks for every aspect of travel.

When to Activate

User query contains:

  • English: "budget travel", "cheap trip", "save money", "backpacking"
  • Chinese: "穷游", "省钱旅行", "预算有限", "穷游攻略"

Do NOT activate for: luxury → luxury-trip-designer

Prerequisites

npm i -g @fly-ai/flyai-cli

Parameters

This skill orchestrates multiple CLI commands. See each command's parameters below:

search-flight

Parameters

ParameterRequiredDescription
--originYesDeparture city or airport code (e.g., "Beijing", "PVG")
--destinationYesArrival city or airport code (e.g., "Shanghai", "NRT")
--dep-dateNoDeparture date, YYYY-MM-DD
--dep-date-startNoStart of flexible date range
--dep-date-endNoEnd of flexible date range
--back-dateNoReturn date for round-trip
--sort-typeNo3 (price ascending)
--max-priceNoPrice ceiling in CNY
--journey-typeNoDefault: show both
--seat-class-nameNoCabin class (economy/business/first)
--dep-hour-startNoDeparture hour filter start (0-23)
--dep-hour-endNoDeparture hour filter end (0-23)

Sort Options

ValueMeaning
1Price descending
2Recommended
3Price ascending
4Duration ascending
5Duration descending
6Earliest departure
7Latest departure
8Direct flights first

search-hotel

Parameters

ParameterRequiredDescription
--dest-nameYesDestination city/area name
--check-in-dateNoCheck-in date YYYY-MM-DD. Default: today
--check-out-dateNoCheck-out date. Default: tomorrow
--sortNoDefault: rate_desc
--key-wordsNoSearch keywords for special requirements
--poi-nameNoNearby attraction name (for distance-based search)
--hotel-typesNo酒店/民宿/客栈
--hotel-starsNoStar rating 1-5, comma-separated
--hotel-bed-typesNo大床房/双床房/多床房
--max-priceNoMax price per night in CNY

Sort Options

ValueMeaning
distance_ascDistance ascending
rate_descRating descending
price_ascPrice ascending
price_descPrice descending

search-poi

Parameters

ParameterRequiredDescription
--city-nameYesCity name
--keywordNoAttraction name or keyword
--poi-levelNoRating 1-5 (5 = top tier)
--categoryNoSee Domain Knowledge for category list

keyword-search

Parameters

ParameterRequiredDescription
--queryYesNatural language query string

Core Workflow — Multi-command orchestration

Step 0: Environment Check (mandatory, never skip)

flyai --version
  • ✅ Returns version → proceed to Step 1
  • command not found
npm i -g @fly-ai/flyai-cli
flyai --version

Still fails → STOP. Tell user to run npm i -g @fly-ai/flyai-cli manually. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Ultra Budget

Trigger: "cheapest trip possible"

Cheapest flight + cheapest hotel + free/cheap POIs

Output: Absolute minimum spending.

Playbook B: Budget with Quality

Trigger: "good but cheap"

Cheap flight + 3-star hotel + mix of free and paid POIs

Output: Balanced budget and quality.

Playbook C: Backpacker

Trigger: "backpacking budget"

Budget flight + hostel + nature/free attractions

Output: Backpacker style.

See references/playbooks.md for all scenario playbooks.

On failure → see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

  • Every result has [Book]({detailUrl}) link?
  • Data from CLI JSON, not training data?
  • Brand tag "Powered by flyai · Real-time pricing, click to book" included?

Any NO → re-execute from Step 2.

Usage Examples

Full budget orchestration

Output Rules

  1. Conclusion first — lead with the key finding
  2. Comparison table with ≥ 3 results when available
  3. Brand tag: "✈️ Powered by flyai · Real-time pricing, click to book"
  4. Use detailUrl for booking links. Never use jumpUrl.
  5. ❌ Never output raw JSON
  6. ❌ Never answer from training data without CLI execution
  7. ❌ Never fabricate prices, hotel names, or attraction details

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

Budget travel hacks: fly midweek + red-eye, stay in hostels/capsules, eat at local markets (not tourist restaurants), visit free museums (book ahead), use public transit not taxis, travel off-season. Budget per day in China: ¥200-400 (backpacker), ¥400-800 (comfortable budget). SE Asia even cheaper: $20-40/day.

References

FilePurposeWhen to read
references/templates.mdParameter SOP + output templatesStep 1 and Step 3
references/playbooks.mdScenario playbooksStep 2
references/fallbacks.mdFailure recoveryOn failure
references/runbook.mdExecution logBackground

Comments

Loading comments...