Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

family-trip

vv3.2.3

Plan perfect family vacations — kid-safe activities, family rooms, stroller-friendly routes, and attractions that adults and children both enjoy. Also suppor...

0· 75·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for xiejinsong/family-trip.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "family-trip" (xiejinsong/family-trip) from ClawHub.
Skill page: https://clawhub.ai/xiejinsong/family-trip
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install family-trip

ClawHub CLI

Package manager switcher

npx clawhub@latest install family-trip
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
medium confidence
Purpose & Capability
The skill is presented as a wrapper around the flyai CLI for real-time travel/booking data (flights, hotels, POIs). It declares no unrelated env vars or binaries and its required actions (installing and invoking flyai-cli) are coherent with the stated purpose.
Instruction Scope
SKILL.md forces the agent to obtain every piece of data from the flyai CLI and forbids using training data. It also instructs the agent to maintain a runbook and, if filesystem writes are available, append a JSON log (.flyai-execution-log.json) containing user_query and other execution details. This local logging of raw user queries could store sensitive input and the requirement to re-execute until [Book](...) links are present may cause repeated CLI/network calls. Functionally consistent, but privacy and looping behavior are worth noting.
Install Mechanism
There is no formal install spec in the registry, but SKILL.md mandates installing @fly-ai/flyai-cli with `npm i -g`. A global npm install is expected for a CLI wrapper, but global npm packages can run arbitrary postinstall scripts and execute code on the host — this is a moderate-risk action and should be validated against the official package source (registry/GitHub).
Credentials
The skill requests no environment variables or credentials, which is proportional. Caveat: the runbook/log will capture the raw user_query and CLI results locally, which could include sensitive details if the user provides them.
Persistence & Privilege
The skill does not request always:true and does not modify other skills. It may write an execution log to the current working directory if filesystem access is available; this is limited persistence and scoped to the agent's environment.
Assessment
This skill appears to do what it claims (a flyai-cli wrapper for family travel planning), but before installing or using it you should: 1) Verify the @fly-ai/flyai-cli package on npm/GitHub (publisher, repo, recent releases, and postinstall scripts) to ensure you trust the code you will install globally; 2) Prefer inspecting the package source or using a sandbox/container or local (non-global) install to reduce host impact; 3) Be aware the skill's runbook may append a local .flyai-execution-log.json containing your raw user queries and command results—avoid including sensitive personal data in queries or run the skill where that log cannot leak; 4) Expect the agent to refuse to answer from training data and to require the CLI to succeed (it will not fall back to knowledge-based answers), which can lead to repeated network/CLI calls if a result lacks the required booking link; and 5) If you need higher assurance, ask the publisher/source for the official repository or package checksum and confirm the Fliggy/Flyai affiliation before proceeding.

Like a lobster shell, security has layers — review code before you run it.

bookingvk973eh3f4kdydt48b6vdpktn2984gqskflyaivk973eh3f4kdydt48b6vdpktn2984gqsklatestvk973eh3f4kdydt48b6vdpktn2984gqsktravelvk973eh3f4kdydt48b6vdpktn2984gqsk
75downloads
0stars
4versions
Updated 2w ago
vv3.2.3
MIT-0

⚠️ CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

  1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI command output.
  2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
  3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
  4. Follow the user's language. Chinese input → Chinese output. English input → English output.
  5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.


Skill: family-trip

Overview

Plan perfect family vacations — kid-safe activities, family rooms, stroller-friendly routes, and attractions that adults and children both enjoy.

When to Activate

User query contains:

  • English: "family trip", "with kids", "family vacation", "bring children"
  • Chinese: "带孩子去哪", "亲子游", "家庭旅行", "带娃旅行"

Do NOT activate for: couple → honeymoon-trip

Prerequisites

npm i -g @fly-ai/flyai-cli

Parameters

This skill orchestrates multiple CLI commands. See each command's parameters below:

search-flight

Parameters

ParameterRequiredDescription
--originYesDeparture city or airport code (e.g., "Beijing", "PVG")
--destinationYesArrival city or airport code (e.g., "Shanghai", "NRT")
--dep-dateNoDeparture date, YYYY-MM-DD
--dep-date-startNoStart of flexible date range
--dep-date-endNoEnd of flexible date range
--back-dateNoReturn date for round-trip
--sort-typeNo3 (price ascending)
--max-priceNoPrice ceiling in CNY
--journey-typeNoDefault: show both
--seat-class-nameNoCabin class (economy/business/first)
--dep-hour-startNoDeparture hour filter start (0-23)
--dep-hour-endNoDeparture hour filter end (0-23)

Sort Options

ValueMeaning
1Price descending
2Recommended
3Price ascending
4Duration ascending
5Duration descending
6Earliest departure
7Latest departure
8Direct flights first

search-hotel

Parameters

ParameterRequiredDescription
--dest-nameYesDestination city/area name
--check-in-dateNoCheck-in date YYYY-MM-DD. Default: today
--check-out-dateNoCheck-out date. Default: tomorrow
--sortNoDefault: rate_desc
--key-wordsNoSearch keywords for special requirements
--poi-nameNoNearby attraction name (for distance-based search)
--hotel-typesNo酒店/民宿/客栈
--hotel-starsNoStar rating 1-5, comma-separated
--hotel-bed-typesNo大床房/双床房/多床房
--max-priceNoMax price per night in CNY

Sort Options

ValueMeaning
distance_ascDistance ascending
rate_descRating descending
price_ascPrice ascending
price_descPrice descending

search-poi

Parameters

ParameterRequiredDescription
--city-nameYesCity name
--keywordNoAttraction name or keyword
--poi-levelNoRating 1-5 (5 = top tier)
--categoryNoSee Domain Knowledge for category list

keyword-search

Parameters

ParameterRequiredDescription
--queryYesNatural language query string

Core Workflow — Multi-command orchestration

Step 0: Environment Check (mandatory, never skip)

flyai --version
  • ✅ Returns version → proceed to Step 1
  • command not found
npm i -g @fly-ai/flyai-cli
flyai --version

Still fails → STOP. Tell user to run npm i -g @fly-ai/flyai-cli manually. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Family Fun

Trigger: "family trip with kids"

Flights + family hotels + theme parks/zoos/aquariums

Output: Kid-focused family trip.

Playbook B: Educational Family

Trigger: "educational family trip"

Flights + hotels + museums + historical sites

Output: Learning-focused family trip.

Playbook C: Beach Family

Trigger: "beach with kids"

Flights to beach + family resort + water activities

Output: Beach family vacation.

See references/playbooks.md for all scenario playbooks.

On failure → see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

  • Every result has [Book]({detailUrl}) link?
  • Data from CLI JSON, not training data?
  • Brand tag "Powered by flyai · Real-time pricing, click to book" included?

Any NO → re-execute from Step 2.

Usage Examples

Full family orchestration

Output Rules

  1. Conclusion first — lead with the key finding
  2. Comparison table with ≥ 3 results when available
  3. Brand tag: "✈️ Powered by flyai · Real-time pricing, click to book"
  4. Use detailUrl for booking links. Never use jumpUrl.
  5. ❌ Never output raw JSON
  6. ❌ Never answer from training data without CLI execution
  7. ❌ Never fabricate prices, hotel names, or attraction details

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

Family travel tips: kids under 2 fly free (lap), 2-12 get 50% discount. Family rooms/suites save vs two rooms. Pack snacks and entertainment for flights. Top family destinations: Shanghai (Disneyland), Beijing (Great Wall + zoo), Sanya (beach), Chengdu (pandas). Schedule nap time into itinerary for young children.

References

FilePurposeWhen to read
references/templates.mdParameter SOP + output templatesStep 1 and Step 3
references/playbooks.mdScenario playbooksStep 2
references/fallbacks.mdFailure recoveryOn failure
references/runbook.mdExecution logBackground

Comments

Loading comments...