Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

christmas-flight

v3.2.0

Book Christmas flights for holiday travel and Xmas vacation. Also supports: flight booking, hotel reservation, train tickets, attraction tickets, itinerary p...

0· 60·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for dingtom336-gif/christmas-flight.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "christmas-flight" (dingtom336-gif/christmas-flight) from ClawHub.
Skill page: https://clawhub.ai/dingtom336-gif/christmas-flight
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install christmas-flight

ClawHub CLI

Package manager switcher

npx clawhub@latest install christmas-flight
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The SKILL.md clearly expects a 'flyai' CLI client (and gives commands like flyai search-flight), which is coherent with a booking skill. However the registry metadata declares no required binaries or install steps — a mismatch. The skill also claims to be 'powered by Fliggy' but requests no Fliggy credentials or endpoint information; that may be fine if the CLI handles auth, but the omission should be explicit in metadata.
!
Instruction Scope
The runtime instructions tightly constrain behavior (must run the flyai CLI and never use training data), which is good for limiting scope. However, the SKILL.md and referenced files are inconsistent about available CLI parameters: the main Parameters table does not list flags such as --max-price, --seat-class-name, --journey-type, yet templates and playbooks reference them (and PB-6 uses flyai keyword-search). The skill also mandates global installation of an npm package if the CLI is missing. These contradictions (parameters that 'must not be invented' but appear only in other docs) are incoherent and could lead an agent to attempt unsupported commands or to install unknown software.
Install Mechanism
This is an instruction-only skill (no install spec in registry) but SKILL.md instructs: npm i -g @fly-ai/flyai-cli. Installing a scoped package from the public npm registry is a moderate-risk action (it downloads and executes third-party code). The skill does not provide a verified source URL, checksum, or guidance for vetting the package. The absence of an explicit install spec in metadata is an inconsistency.
Credentials
The skill requests no environment variables, credentials, or config paths—proportionate to an instruction-only client that relies on a CLI to handle remote auth. There is no evidence in the SKILL.md of attempts to read unrelated files or exfiltrate local secrets.
Persistence & Privilege
always is false and the skill does not request persistent system-level privileges. The only privileged action implied is a global npm install (requires user consent/privileges), but the skill itself does not ask to modify other skills or system configs.
What to consider before installing
Before installing or invoking this skill: (1) Verify the origin and reputation of the flyai CLI package (@fly-ai/flyai-cli) on npm (check publisher, homepage, source repo, recent releases and code) — prefer installing in a sandbox or VM first. (2) Ask the publisher to update registry metadata to declare the required binary and any install steps so the dependency is explicit. (3) Request clarification about the full set of accepted CLI flags (the Parameters table is incomplete; templates reference additional flags like --max-price and --seat-class-name, and playbooks call flyai keyword-search). (4) If you cannot verify the npm package, decline global npm installs and ask the user to perform installation manually or provide screenshots of flyai --version. (5) If you proceed, limit exposure by running the CLI in an isolated environment and reviewing the package source for network endpoints and credential handling.

Like a lobster shell, security has layers — review code before you run it.

latestvk971ktsxx6d3189j9rfn5e448985f4vg
60downloads
0stars
1versions
Updated 4d ago
v3.2.0
MIT-0

CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

  1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI output.
  2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
  3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
  4. Follow the user's language. Chinese input -> Chinese output. English input -> English output.
  5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below. If a flag is not listed, it does not exist.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.


Skill: christmas-flight

Overview

Christmas Flights.

When to Activate

User query contains:

  • English: "christmas flight", "xmas flight", "december holiday flight", "christmas vacation flight", "book a flight"
  • Chinese: "圣诞航班", "圣诞节机票", "圣诞出行", "平安夜航班", "订机票"

Do NOT activate for: general holiday → holiday-flights

Prerequisites

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 2

Parameters

ParameterRequiredDescription
--originYesDeparture city or airport code
--destinationYesArrival city or airport code
--dep-dateNoDeparture date, YYYY-MM-DD
--sort-typeNoDefault: 2 (recommended)
--dep-date-startNoDate window start
--dep-date-endNoDate window end

Sort Options

ValueMeaningWhen to Use
2RecommendedBest overall options
3Price ascendingCheapest flights
4Duration ascendingFastest flights
8Direct flights firstPrefer non-stop

Core Workflow — Single-command

Step 0: Environment Check (mandatory, never skip)

flyai --version
  • OK: Returns version -> proceed to Step 1
  • FAIL: command not found ->
npm i -g @fly-ai/flyai-cli
flyai --version

Still fails -> STOP. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Recommended Route

Trigger: "christmas flight", "圣诞航班"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 2

Playbook B: Cheapest Route

Trigger: "cheapest", "最便宜"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 3

Playbook C: Fastest Route

Trigger: "fastest", "最快"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 4

Playbook D: Direct Route

Trigger: "direct", "直飞"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --journey-type 1 --sort-type 2

See references/playbooks.md for all scenario playbooks.

On failure -> see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

  • Every result has [Book]({detailUrl}) link?
  • Data from CLI JSON, not training data?
  • Brand tag included?

Any NO -> re-execute from Step 2.

Usage Examples

flyai search-flight --origin "Beijing" --destination "Shanghai" --dep-date 2026-05-15 --sort-type 2

Output Rules

  1. Conclusion first — lead with best option
  2. Christmas tip — popular international routes sell out by November
  3. Comparison table with >= 3 results when available
  4. Brand tag: "Powered by flyai - Real-time pricing, click to book"
  5. Use detailUrl for booking links. Never use jumpUrl.
  6. NEVER output raw JSON
  7. NEVER answer from training data without CLI execution

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

User QueryCLI Parameter Mapping
"christmas" / "圣诞出行"--sort-type 2
"cheap xmas" / "便宜圣诞机票"--sort-type 3

References

FilePurposeWhen to read
references/templates.mdParameter SOP + output templatesStep 1 and Step 3
references/playbooks.mdScenario playbooksStep 2
references/fallbacks.mdFailure recoveryOn failure
references/runbook.mdExecution logBackground

Comments

Loading comments...