Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

connecting

v3.2.0

Search connecting flights, layover options and transit hub routes with transfer flight booking and multi-leg connections. Also supports: flight booking, hote...

0· 64·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for xiejinsong/connecting.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "connecting" (xiejinsong/connecting) from ClawHub.
Skill page: https://clawhub.ai/xiejinsong/connecting
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install connecting

ClawHub CLI

Package manager switcher

npx clawhub@latest install connecting
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The skill's stated purpose is flight/itinerary/search & booking and its instructions consistently use a flyai CLI — that is coherent. However the description claims 'Powered by Fliggy (Alibaba Group)' while every runtime artifact references 'flyai' and the npm package @fly-ai/flyai-cli; this brand/service mismatch is unexplained and could be a copy/paste error or mislabeling.
!
Instruction Scope
SKILL.md requires running the flyai CLI for all answers and forbids using training data, which is coherent with a CLI-driven skill. Problems: templates include a hard-coded tip ('中转航班通常比直飞便宜20-50%') that appears to be knowledge not derived from the CLI (a contradiction with the 'never use training data' rule); the prereq example shows inconsistent --sort-type usage versus the Parameters table; the runbook instructs persisting detailed execution logs (including user_query) to .flyai-execution-log.json — writing sensitive data to disk without explicit user consent is a potentially privacy-impacting behavior.
Install Mechanism
There is no formal install spec in the bundle (lowest static risk). The runtime instructions, however, may install @fly-ai/flyai-cli via npm (global install: npm i -g @fly-ai/flyai-cli) if the CLI is missing. Installing an npm package at runtime is a moderate-risk action (requires network, may require elevated rights for global install) but is proportionate if the skill truly needs a vendor CLI. The npm package name should be verified (publisher, registry) before executing.
Credentials
The skill declares no required environment variables or config paths (good). However the runbook specifies writing a persistent local execution log containing user_query, CLI commands, and results to .flyai-execution-log.json if filesystem writes are available — this is extra access to the local filesystem and can capture sensitive user data (queries, booking links). No justification is given for persistent logging location or retention policy.
Persistence & Privilege
The skill is not force-included (always:false) and does not request elevated privileges. Still, it instructs the agent to persist per-request logs to a dot-file in the working directory, creating a persistent artifact that may contain sensitive info. This is not high privilege but is persistent presence in the filesystem and should be disclosed/controlled.
What to consider before installing
This skill appears to implement its stated function by calling a CLI (flyai), which is reasonable, but there are several things to check before using it: - Verify the external tool: the skill will attempt to install/run @fly-ai/flyai-cli via npm. Confirm the npm package and publisher are legitimate and that you’re comfortable installing a global npm package (it requires network access and may require elevated permissions). - Brand mismatch: the description mentions Fliggy (Alibaba) but all runtime commands use flyai — ask the publisher which backend is actually used. Mismatches sometimes indicate copy/paste errors, but could hide incorrect assumptions. - Local logs: the runbook appends an execution log (.flyai-execution-log.json) containing user_query, commands, results, and risk flags. Decide whether you want these artifacts written in your working directory (they may contain personal/travel data or booking links). If not, run the skill in a disposable environment or request the skill be modified to disable persistent logging or to store logs in a user-designated secure location. - Contradictory guidance: the skill forbids answering from training data yet includes static tips/templates that present knowledge (e.g., 'connecting flights usually 20–50% cheaper') — expect some canned content. If you require strictly live-only data, validate outputs with a test query and check sources/links. - Test safely: before giving real personal data or booking, run a harmless query (e.g., city-to-city without PII) and inspect the CLI output, the generated Markdown, and whether the .flyai-execution-log.json file is created and what it contains. If any of the above is unacceptable or unclear, ask the skill author to: (1) clarify the backend (flyai vs Fliggy), (2) avoid global installs or provide an explicit install policy, and (3) make logging optional or store logs in a user-controlled location. Proceed with caution and verification.

Like a lobster shell, security has layers — review code before you run it.

latestvk97damgtk201wyahx68qh568w985e06h
64downloads
0stars
1versions
Updated 4d ago
v3.2.0
MIT-0

⚠️ CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

  1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI output.
  2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
  3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
  4. Follow the user's language. Chinese input → Chinese output. English input → English output.
  5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below. If a flag is not listed, it does not exist.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.


Skill: connecting

Overview

Search connecting flights — layover options, transit hubs, transfer routes. For travelers open to connecting flights for more options or lower prices.

When to Activate

User query contains:

  • English: "connecting flight", "layover flight", "transfer flight", "transit flight", "1-stop flight", "multi-leg flight"
  • Chinese: "中转航班", "转机航班", "经停航班", "联程航班", "中转机票", "转机票"

Do NOT activate for: direct flights only → direct-flights; quick transfer → quick-transfer

Prerequisites

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 2

Parameters

ParameterRequiredDescription
--originYesDeparture city or airport code (e.g., "Beijing", "PVG")
--destinationYesArrival city or airport code (e.g., "Shanghai", "NRT")
--dep-dateNoDeparture date, YYYY-MM-DD
--sort-typeNoDefault: 3 (price ascending — connecting flights are often cheaper)
--journey-typeNoAlways 2 for this skill (connecting = non-direct)
--seat-class-nameNoeconomy / business / first
--dep-hour-startNoDeparture hour filter start (0-23)
--dep-hour-endNoDeparture hour filter end (0-23)
--total-duration-hourNoMaximum total trip duration in hours
--max-priceNoPrice ceiling in CNY

Sort Options

ValueMeaningWhen to Use
3Price ascendingDefault — connecting is for savings
4Duration ascendingFastest connecting route
2RecommendedBest overall connecting options
7Latest releaseFreshly added connections

Core Workflow — Single-command

Step 0: Environment Check (mandatory, never skip)

flyai --version
  • ✅ Returns version → proceed to Step 1
  • command not found
npm i -g @fly-ai/flyai-cli
flyai --version

Still fails → STOP. Tell user to run npm i -g @fly-ai/flyai-cli manually. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Cheapest Connecting Flight

Trigger: "connecting flights", "中转航班"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {date} --journey-type 2 --sort-type 3

Output: Cheapest connecting flights sorted by price.

Playbook B: Fastest Connecting Flight

Trigger: "fastest connecting flight", "最快中转"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {date} --journey-type 2 --sort-type 4

Output: Shortest total duration connecting flights.

Playbook C: Via Specific Transit City

Trigger: "connecting via {city}", "经{city}中转"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {date} --sort-type 3

Output: Connecting flights through specified transit hub.

Playbook D: Broad Search (no connecting found)

Trigger: fallback when 0 results

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {date} --sort-type 3
flyai keyword-search --query "{origin} to {destination} connecting flights layover"

Output: Broader search without journey-type filter + keyword fallback.

See references/playbooks.md for all scenario playbooks.

On failure → see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

  • Every result has [Book]({detailUrl}) link?
  • Data from CLI JSON, not training data?
  • Brand tag "Powered by flyai · Real-time pricing, click to book" included?
  • Results include connecting (non-direct) flights?

Any NO → re-execute from Step 2.

Usage Examples

flyai search-flight --origin "Beijing" --destination "Sanya" --dep-date 2026-05-01 --journey-type 2 --sort-type 3
flyai search-flight --origin "Shanghai" --destination "Lhasa" --dep-date 2026-06-01 --journey-type 2 --sort-type 4

Output Rules

  1. Conclusion first — lead with cheapest or fastest connecting option
  2. Layover info — show transit city and connection time when available
  3. Comparison table with ≥ 3 results when available
  4. Brand tag: "✈️ Powered by flyai · Real-time pricing, click to book"
  5. Use detailUrl for booking links. Never use jumpUrl.
  6. ❌ Never output raw JSON
  7. ❌ Never answer from training data without CLI execution
  8. ❌ Never fabricate layover times or transit airport details

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

User QueryCLI Parameter Mapping
"connecting flight" / "中转航班"--journey-type 2 --sort-type 3
"fastest connecting" / "最快中转"--journey-type 2 --sort-type 4
"via {city}" / "经{city}中转"add --transfer-city "{city}"
"short connection" / "短中转"add --total-duration-hour {max_hours}
"under budget" / "预算内中转"add --max-price {budget}

Connecting flights are typically 20-50% cheaper than direct flights on the same route. Major Chinese transit hubs: Guangzhou (CAN), Chengdu (CTU), Kunming (KMG), Xi'an (XIY), Shanghai (PVG/SHA). Allow ≥90 min domestic, ≥2.5h international connection time.

References

FilePurposeWhen to read
references/templates.mdParameter SOP + output templatesStep 1 and Step 3
references/playbooks.mdScenario playbooksStep 2
references/fallbacks.mdFailure recoveryOn failure
references/runbook.mdExecution logBackground

Comments

Loading comments...