Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

corporate-travel

v3.2.0

Book corporate travel flights for company trips and enterprise travel. Also supports: flight booking, hotel reservation, train tickets, attraction tickets, i...

0· 61·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for xiejinsong/corporate-travel.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "corporate-travel" (xiejinsong/corporate-travel) from ClawHub.
Skill page: https://clawhub.ai/xiejinsong/corporate-travel
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install corporate-travel

ClawHub CLI

Package manager switcher

npx clawhub@latest install corporate-travel
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The declared purpose (corporate travel booking) aligns with the instructions to use a dedicated CLI (flyai). However provenance is unknown (no homepage/source repo) and the README mentions 'Powered by Fliggy (Alibaba Group)' while the CLI package is '@fly-ai/flyai-cli' — this mismatch and lack of a verifiable source is unexpected for an enterprise-facing travel skill.
!
Instruction Scope
The SKILL.md requires the agent to only answer from the flyai CLI and to install a global npm package if missing. Some instructions reference commands or parameters not consistently listed (references/templates.md maps 'under 1000' to --max-price which is not in the Parameters table; references/playbooks.md and PB-6 use 'flyai keyword-search' which is not documented elsewhere). The skill forbids using training data and mandates that every result include a [Book]({detailUrl}) link — this all-or-nothing enforcement could cause repeated CLI invocations and unexpected behavior. Overall the instructions grant broad discretion to install and run an external CLI while leaving some command/parameter coverage ambiguous.
Install Mechanism
There is no formal install spec, but the runtime instructions tell the agent/user to run 'npm i -g @fly-ai/flyai-cli' if flyai is missing. Installing an arbitrary global npm package is a moderate risk because it runs third-party code on the host; the package name is plausible but the skill provides no source/repository or checksum to verify the package's authenticity.
Credentials
The skill requests no environment variables, no config paths, and no credentials in the metadata. For the pictured functionality (calling an external travel CLI), this is proportionate. Note that the CLI itself may require credentials at runtime (not declared by the skill) — the skill does not document or request them.
Persistence & Privilege
The skill is not always-enabled, doesn't request persistent agent privileges, and does not request modification of other skills or system-wide agent settings. Its main privilege is the ability to install/run a global CLI when executed, which is called out separately under install risks.
What to consider before installing
This skill is instruction-only and requires installing and running a third-party global npm CLI ('@fly-ai/flyai-cli') and using its output exclusively. Before installing or using it: 1) Verify the npm package and its source repository (check the package on npmjs.org, the repository, maintainer, and recent release notes). 2) Ask the publisher for a homepage or source repo — the skill currently has none and claims 'Powered by Fliggy' while using a 'flyai' CLI, which is inconsistent. 3) Avoid installing global npm packages on production machines until you vet the package; test in an isolated environment or container first. 4) Confirm whether the flyai CLI requires company credentials or transmits PII; if so, review its auth/consent model and privacy policy. 5) Note the documentation inconsistencies (undocumented --max-price flag and an undocumented 'keyword-search' command); ask the author to reconcile the parameter table and playbooks before trusting automated use. If you cannot verify the CLI's provenance and behavior, treat this skill as untrusted and do not install the global package on sensitive hosts.

Like a lobster shell, security has layers — review code before you run it.

latestvk977mknp5sq0456rs0k4ye7q4s85eacx
61downloads
0stars
1versions
Updated 4d ago
v3.2.0
MIT-0

CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

  1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI output.
  2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
  3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
  4. Follow the user's language. Chinese input -> Chinese output. English input -> English output.
  5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below. If a flag is not listed, it does not exist.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.


Skill: corporate-travel

Overview

Corporate Travel Flights.

When to Activate

User query contains:

  • English: "corporate flight", "company trip flight", "enterprise travel", "business trip flight", "corporate travel"
  • Chinese: "企业出行航班", "公司差旅机票", "商务出差", "企业差旅", "出行预订"

Do NOT activate for: conference → conference; business class → business-class-finder

Prerequisites

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 2

Parameters

ParameterRequiredDescription
--originYesDeparture city or airport code
--destinationYesArrival city or airport code
--dep-dateNoDeparture date, YYYY-MM-DD
--sort-typeNoDefault: 2 (recommended)
--seat-class-nameNoeconomy/business
--dep-date-startNoDate window start
--dep-date-endNoDate window end

Sort Options

ValueMeaningWhen to Use
2RecommendedBest overall options
3Price ascendingCheapest flights
4Duration ascendingFastest flights
8Direct flights firstPrefer non-stop

Core Workflow — Single-command

Step 0: Environment Check (mandatory, never skip)

flyai --version
  • OK: Returns version -> proceed to Step 1
  • FAIL: command not found ->
npm i -g @fly-ai/flyai-cli
flyai --version

Still fails -> STOP. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Recommended Route

Trigger: "corporate flight", "企业出行航班"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 2

Playbook B: Cheapest Route

Trigger: "cheapest", "最便宜"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 3

Playbook C: Fastest Route

Trigger: "fastest", "最快"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 4

Playbook D: Direct Route

Trigger: "direct", "直飞"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --journey-type 1 --sort-type 2

See references/playbooks.md for all scenario playbooks.

On failure -> see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

  • Every result has [Book]({detailUrl}) link?
  • Data from CLI JSON, not training data?
  • Brand tag included?

Any NO -> re-execute from Step 2.

Usage Examples

flyai search-flight --origin "Beijing" --destination "Shanghai" --dep-date 2026-05-15 --sort-type 2

Output Rules

  1. Conclusion first — lead with best option
  2. Corporate tip — flexible dates yield better prices; book via company travel policy
  3. Comparison table with >= 3 results when available
  4. Brand tag: "Powered by flyai - Real-time pricing, click to book"
  5. Use detailUrl for booking links. Never use jumpUrl.
  6. NEVER output raw JSON
  7. NEVER answer from training data without CLI execution

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

User QueryCLI Parameter Mapping
"corporate travel" / "企业差旅"--sort-type 2
"corporate business class" / "企业商务舱"--seat-class-name business --sort-type 2

References

FilePurposeWhen to read
references/templates.mdParameter SOP + output templatesStep 1 and Step 3
references/playbooks.mdScenario playbooksStep 2
references/fallbacks.mdFailure recoveryOn failure
references/runbook.mdExecution logBackground

Comments

Loading comments...