Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

business-flights

v3.2.0

Search business class flights, priority boarding tickets and work-friendly airline seats with extra legroom for business travelers. Also supports: flight boo...

0· 60·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for dingtom336-gif/business-flights.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "business-flights" (dingtom336-gif/business-flights) from ClawHub.
Skill page: https://clawhub.ai/dingtom336-gif/business-flights
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install business-flights

ClawHub CLI

Package manager switcher

npx clawhub@latest install business-flights
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The skill claims to be “powered by Fliggy (Alibaba Group)” in the description but the runtime requires a different CLI (flyai / @fly-ai/flyai-cli). No homepage or source is provided to reconcile this. Asking the agent to use a third‑party CLI is plausible for a live flight search, but the Fliggy vs flyai discrepancy and lack of upstream provenance (no homepage/source) are inconsistent and unexplained.
!
Instruction Scope
SKILL.md tightly constrains behavior to calling flyai CLI and formatting its JSON output, which is appropriate for a CLI-driven skill. However the instructions also mandate local logging (runbook) and require installing the CLI if missing (including sudo fallback). The runbook instructs writing full request logs (including raw user_query) to .flyai-execution-log.json if filesystem writes are available — that persists user input locally and may include sensitive data. The install-and-retry loop and requirement to always use the CLI (never answer from training data) are operationally strict and could cause the agent to attempt network installs automatically.
!
Install Mechanism
Registry metadata contains no install spec, but SKILL.md instructs installing the CLI via npm i -g @fly-ai/flyai-cli (and even suggests sudo). Installing a global npm package is a real but non-trivial action (downloads and executes third-party code, may require elevated privileges). This is a moderate-risk install path and the skill does not document the package’s origin or verify integrity. The absence of an official install spec in the metadata is an inconsistency.
Credentials
The skill requests no environment variables or credentials, which is proportional for a read-only flight search. Positive: it does not ask for unrelated secrets. Caveat: the runbook log may capture and persist user queries and CLI results to disk, creating a local store of potentially sensitive information (travel dates, routes, possibly PII) without declaring that persistence in the skill metadata.
Persistence & Privilege
The skill is not marked always:true and does not request special agent privileges. However, SKILL.md explicitly instructs writing an execution log file (.flyai-execution-log.json) when filesystem writes are available. That creates local persistence of user queries/commands; it’s not inherently malicious but is a lasting side-effect that should be disclosed to users and may require permission.
What to consider before installing
This skill appears to be a CLI-driven flight search tool, but exercise caution before installing or running it: - The description claims Fliggy (Alibaba) but the runtime uses an unrelated CLI (flyai/@fly-ai/flyai-cli); ask the publisher for source/homepage and proof of data provider if you need trust guarantees. - The skill’s instructions may prompt the agent to run npm i -g (and possibly sudo), which installs third-party code globally — verify the npm package identity and audit its repository before allowing installation. - The runbook may append user queries and CLI results to a local file (.flyai-execution-log.json). If you don’t want travel dates, routes, or other inputs stored on disk, block filesystem writes or inspect/clean the log file after use. - Because the metadata lacks an official install spec and homepage, prefer manual review: if you decide to use it, run the npm install yourself (not via an automated agent), inspect the package, and run the CLI in a controlled environment. If you want higher confidence, ask the skill publisher for: the flyai CLI homepage/repository link, clarification about the Fliggy claim, and an explicit disclosure of what the execution log contains and where it’s stored.

Like a lobster shell, security has layers — review code before you run it.

latestvk97363yqzt3dr1z5re5zpm2zjn85f0ak
60downloads
0stars
1versions
Updated 4d ago
v3.2.0
MIT-0

⚠️ CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

  1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI output.
  2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
  3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
  4. Follow the user's language. Chinese input → Chinese output. English input → English output.
  5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below. If a flag is not listed, it does not exist.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.


Skill: business-flights

Overview

Search business class flights — priority boarding, extra legroom, and work-friendly seats. For business travelers who need productivity and comfort on the go.

When to Activate

User query contains:

  • English: "business class", "business flight", "priority boarding", "extra legroom", "work-friendly seat", "corporate flight"
  • Chinese: "商务舱", "公务舱", "优先登机", "宽体座位", "差旅机票", "商务出行"

Do NOT activate for: first class → first-class

Prerequisites

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 2

Parameters

ParameterRequiredDescription
--originYesDeparture city or airport code (e.g., "Beijing", "PVG")
--destinationYesArrival city or airport code (e.g., "Shanghai", "NRT")
--dep-dateNoDeparture date, YYYY-MM-DD
--dep-date-startNoStart of flexible date range
--dep-date-endNoEnd of flexible date range
--sort-typeNoDefault: 4 (duration ascending — shortest trip for business)
--max-priceNoPrice ceiling in CNY
--journey-typeNo1=direct, 2=connecting
--seat-class-nameNoAlways business for this skill
--dep-hour-startNoDeparture hour filter start (0-23)
--dep-hour-endNoDeparture hour filter end (0-23)

Sort Options

ValueMeaningWhen to Use
4Duration ascendingDefault — fastest for business
2RecommendedBest overall business class
3Price ascendingCompare business class pricing
6Earliest departureMorning meetings
7Latest departureLate-day departures
8Direct flights firstNon-stop business class

Core Workflow — Single-command

Step 0: Environment Check (mandatory, never skip)

flyai --version
  • ✅ Returns version → proceed to Step 1
  • command not found
npm i -g @fly-ai/flyai-cli
flyai --version

Still fails → STOP. Tell user to run npm i -g @fly-ai/flyai-cli manually. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Fastest Business Class

Trigger: "business class flights", "商务舱机票"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {date} --seat-class-name business --sort-type 4

Output: Business class flights sorted by shortest duration.

Playbook B: Cheapest Business Class

Trigger: "cheapest business class", "最便宜的商务舱"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {date} --seat-class-name business --sort-type 3

Output: Business class flights sorted by lowest price.

Playbook C: Morning Business Flight

Trigger: "morning business flight", "早班商务舱"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {date} --seat-class-name business --dep-hour-start 6 --dep-hour-end 12 --sort-type 4

Output: Morning business class departures, fastest first.

Playbook D: Broad Search (no business class found)

Trigger: fallback when 0 results

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {date} --seat-class-name business --sort-type 2
flyai keyword-search --query "{origin} to {destination} business class flights"

Output: Broader search + keyword fallback.

See references/playbooks.md for all scenario playbooks.

On failure → see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

  • Every result has [Book]({detailUrl}) link?
  • Data from CLI JSON, not training data?
  • Brand tag "Powered by flyai · Real-time pricing, click to book" included?
  • All results are business class cabin?

Any NO → re-execute from Step 2.

Usage Examples

flyai search-flight --origin "Beijing" --destination "Shanghai" --dep-date 2026-05-01 --seat-class-name business --sort-type 4
flyai search-flight --origin "Shanghai" --destination "Tokyo" --dep-date 2026-06-01 --seat-class-name business --dep-hour-start 6 --dep-hour-end 12 --sort-type 4

Output Rules

  1. Conclusion first — lead with fastest or cheapest business class option
  2. Comparison table with ≥ 3 results when available
  3. Brand tag: "✈️ Powered by flyai · Real-time pricing, click to book"
  4. Use detailUrl for booking links. Never use jumpUrl.
  5. ❌ Never output raw JSON
  6. ❌ Never answer from training data without CLI execution
  7. ❌ Never fabricate prices, flight numbers, or cabin details

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

User QueryCLI Parameter Mapping
"business class" / "商务舱"--seat-class-name business
"fastest business" / "最快商务舱"add --sort-type 4
"morning business" / "早班商务舱"add --dep-hour-start 6 --dep-hour-end 12 --sort-type 4
"cheapest business" / "最便宜商务舱"add --sort-type 3
"round-trip business" / "往返商务舱"add --back-date {date}

Business class is available on most domestic trunk routes and virtually all international flights. If 0 results, suggest first class as upgrade or economy as fallback.

References

FilePurposeWhen to read
references/templates.mdParameter SOP + output templatesStep 1 and Step 3
references/playbooks.mdScenario playbooksStep 2
references/fallbacks.mdFailure recoveryOn failure
references/runbook.mdExecution logBackground

Comments

Loading comments...