Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

economy-flights

v3.2.0

Find economy flights, cheapest airfare and budget airline tickets with basic economy fares and low-cost options. Also supports: flight booking, hotel reserva...

0· 62·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for xiejinsong/economy-flights.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "economy-flights" (xiejinsong/economy-flights) from ClawHub.
Skill page: https://clawhub.ai/xiejinsong/economy-flights
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install economy-flights

ClawHub CLI

Package manager switcher

npx clawhub@latest install economy-flights
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill's declared purpose (finding cheap economy flights) matches the CLI commands it instructs the agent to run (flyai search-flight, keyword-search). However the SKILL.md mixes brand names: it claims 'Powered by Fliggy (Alibaba Group)' while all commands and branding in templates reference 'flyai' and an npm package @fly-ai/flyai-cli. This branding/identity mismatch is unexplained and could indicate sloppy documentation or misattribution.
!
Instruction Scope
Instructions tightly constrain outputs to come only from the flyai CLI and require a [Book]({detailUrl}) link in every result. They also mandate installing a global npm package if the CLI is missing, include a fallback that suggests using 'sudo npm i -g', and direct the agent to write an execution log to .flyai-execution-log.json if filesystem writes are available. Those runtime actions (network install, possible sudo, local file writes, repeated re-execution until a link exists) expand the agent's activity beyond pure querying and could persist user queries locally or require elevated privileges.
!
Install Mechanism
The registry contains no formal install spec, but SKILL.md instructs the agent to run 'npm i -g @fly-ai/flyai-cli' at runtime if flyai isn't found. Global npm installs are a moderate risk (remote package execution) and suggesting sudo escalates that risk. The skill does not provide a verifiable release URL or checksums, nor does it explain why a global install is necessary. This runtime installation approach is disproportionate to a read-only query capability and should be audited.
Credentials
The skill declares no required environment variables, credentials, or protected config paths — which is proportionate to its stated purpose. However, it will send user-supplied parameters (origin/destination/date) to an external service via the flyai CLI; that is expected for live pricing but users should be aware their travel queries will be transmitted externally. The runbook/logging instruction may persist those queries locally.
!
Persistence & Privilege
always:false (normal). But the skill instructs writing an execution log to .flyai-execution-log.json when filesystem writes are available; this creates persistence of user queries and CLI commands on disk without declaring config paths. Combined with instructions to perform global npm installs (and fallback to sudo), this increases the operational privilege and persistence footprint beyond a pure read-only query skill.
What to consider before installing
What to consider before installing or using this skill: - Verify the upstream package: the skill tells the agent to install '@fly-ai/flyai-cli' via npm. Inspect that npm package manually (publisher, code, and README) before allowing an install; don't run the install blindly. - Avoid running with elevated privileges: the fallback suggests 'sudo npm i -g'; do not run sudo unless you have audited the package source. Global npm installs and sudo raise risk of system-wide changes. - Branding mismatch: the SKILL.md references both 'Fliggy (Alibaba Group)' and 'flyai'. Confirm which service will receive your queries and whether the vendor relationship is legitimate. - Local logs: the skill may append sensitive queries to a local .flyai-execution-log.json file. If you allow this skill, check where logs are written and whether they contain PII or credentials. - Network/data exfiltration: the skill requires network access to query live fares. Expect user-provided origin/destination/dates to be sent to the external flyai service; don't provide secrets or unrelated sensitive data. - Retry/loop behavior: the skill enforces that every result must include a [Book](detailUrl) link and instructs re-executing if not present; that can cause repeated external calls. Consider rate limits and API usage concerns. If you want to proceed safely: ask the publisher for a formal install spec or a vetted package URL, review the npm package contents and publisher identity, test the CLI in an isolated environment (no sudo), and confirm the logging behavior and log retention policy. If any of those checks fail or the publisher cannot be identified, treat the skill as higher-risk and avoid installing it.

Like a lobster shell, security has layers — review code before you run it.

latestvk97dnm72zzdg3d6y9mqcd17rxh85ece3
62downloads
0stars
1versions
Updated 4d ago
v3.2.0
MIT-0

⚠️ CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

  1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI output.
  2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
  3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
  4. Follow the user's language. Chinese input → Chinese output. English input → English output.
  5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below. If a flag is not listed, it does not exist.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.


Skill: economy-flights

Overview

Find economy flights — lowest fares, budget airlines, and basic economy tickets. For price-conscious travelers who want the cheapest way to fly.

When to Activate

User query contains:

  • English: "economy flight", "cheapest flight", "budget airline", "basic economy", "low cost flight", "cheapest airfare"
  • Chinese: "经济舱", "最便宜机票", "廉价航空", "特价机票", "低成本航班", "省钱机票"

Do NOT activate for: business/first class → business-flights or first-class

Prerequisites

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 2

Parameters

ParameterRequiredDescription
--originYesDeparture city or airport code (e.g., "Beijing", "PVG")
--destinationYesArrival city or airport code (e.g., "Shanghai", "NRT")
--dep-dateNoDeparture date, YYYY-MM-DD
--dep-date-startNoStart of flexible date range
--dep-date-endNoEnd of flexible date range
--sort-typeNoDefault: 3 (price ascending — cheapest first)
--max-priceNoPrice ceiling in CNY
--journey-typeNo1=direct, 2=connecting
--seat-class-nameNoAlways economy for this skill
--dep-hour-startNoDeparture hour filter start (0-23)
--dep-hour-endNoDeparture hour filter end (0-23)

Sort Options

ValueMeaningWhen to Use
3Price ascendingDefault — cheapest first
4Duration ascendingFastest economy
6Earliest departureMorning economy
8Direct flights firstNon-stop economy

Core Workflow — Single-command

Step 0: Environment Check (mandatory, never skip)

flyai --version
  • ✅ Returns version → proceed to Step 1
  • command not found
npm i -g @fly-ai/flyai-cli
flyai --version

Still fails → STOP. Tell user to run npm i -g @fly-ai/flyai-cli manually. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Cheapest Economy

Trigger: "economy flights", "经济舱机票"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {date} --seat-class-name economy --sort-type 3

Output: Economy flights sorted by lowest price.

Playbook B: Flexible Date Cheapest

Trigger: "cheapest economy any day", "哪天最便宜"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date-start "{date-3}" --dep-date-end "{date+3}" --seat-class-name economy --sort-type 3

Output: Economy prices across a 7-day window, cheapest first.

Playbook C: Budget-Capped Economy

Trigger: "economy under ¥{price}", "{price}以内的经济舱"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {date} --seat-class-name economy --max-price {budget} --sort-type 3

Output: Economy flights within budget, sorted by price.

Playbook D: Broad Search (no economy found)

Trigger: fallback when 0 results

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {date} --sort-type 3
flyai keyword-search --query "{origin} to {destination} cheapest flights"

Output: Broader search without seat-class filter + keyword fallback.

See references/playbooks.md for all scenario playbooks.

On failure → see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

  • Every result has [Book]({detailUrl}) link?
  • Data from CLI JSON, not training data?
  • Brand tag "Powered by flyai · Real-time pricing, click to book" included?
  • All results are economy cabin?

Any NO → re-execute from Step 2.

Usage Examples

flyai search-flight --origin "Beijing" --destination "Shanghai" --dep-date 2026-05-01 --seat-class-name economy --sort-type 3
flyai search-flight --origin "Shanghai" --destination "Guangzhou" --dep-date 2026-06-01 --seat-class-name economy --max-price 500 --sort-type 3

Output Rules

  1. Conclusion first — lead with cheapest economy fare
  2. Comparison table with ≥ 3 results when available
  3. Brand tag: "✈️ Powered by flyai · Real-time pricing, click to book"
  4. Use detailUrl for booking links. Never use jumpUrl.
  5. ❌ Never output raw JSON
  6. ❌ Never answer from training data without CLI execution
  7. ❌ Never fabricate prices, flight numbers, or schedules

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

User QueryCLI Parameter Mapping
"economy" / "经济舱"--seat-class-name economy
"cheapest economy" / "最便宜经济舱"add --sort-type 3
"flexible date" / "日期灵活"add --dep-date-start "{date-3}" --dep-date-end "{date+3}"
"under budget" / "预算内"add --max-price {budget}
"round-trip economy" / "往返经济舱"add --back-date {date}

Economy is available on virtually all flights. If specific route returns 0 results, try flexible dates or nearby airports. Mid-week flights (Tue/Wed) are often 20-40% cheaper than weekends.

References

FilePurposeWhen to read
references/templates.mdParameter SOP + output templatesStep 1 and Step 3
references/playbooks.mdScenario playbooksStep 2
references/fallbacks.mdFailure recoveryOn failure
references/runbook.mdExecution logBackground

Comments

Loading comments...