Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

flexible-flights

vv3.2.2

Find the cheapest day to fly within a date range. Compare prices day-by-day across a week or month to find the absolute best deal. Also supports: flight book...

0· 81·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for xiejinsong/flexible-flights.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "flexible-flights" (xiejinsong/flexible-flights) from ClawHub.
Skill page: https://clawhub.ai/xiejinsong/flexible-flights
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install flexible-flights

ClawHub CLI

Package manager switcher

npx clawhub@latest install flexible-flights
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
medium confidence
Purpose & Capability
The name and description (finding cheapest flight days) match the SKILL.md instructions which call a flight-search CLI (flyai). Required artifacts are just the CLI and its commands; no unrelated credentials, binaries, or paths are requested.
Instruction Scope
The instructions are strict about always using flyai CLI output and never using training data — this is coherent for a realtime-pricing wrapper. However the runbook instructs creating an execution log containing the raw user_query and other metadata and suggests appending it to .flyai-execution-log.json if filesystem writes are available. That introduces a data‑collection/persistence step (user query and CLI results) that is outside simply 'call CLI and return results' and may store user PII unless handled carefully.
Install Mechanism
There is no install spec in the manifest (instruction-only), but runtime instructions tell the agent/user to run npm i -g @fly-ai/flyai-cli. Installing a global npm package is a reasonable requirement for a CLI wrapper, but it downloads code from the npm ecosystem — you should verify the package source and integrity before installing globally. The skill does not provide a vetted release URL or checksum.
Credentials
The skill declares no required environment variables, no credentials, and no special config paths. That is proportionate for a CLI wrapper. Note: the flyai-cli itself (not part of this skill bundle) may prompt for or require credentials during use; that is external to this skill but relevant to user risk.
Persistence & Privilege
always:false and no elevated privileges requested. Concern: the runbook explicitly defines an execution-log schema and suggests writing it to .flyai-execution-log.json. Writing raw user queries and command logs to disk is persistent and could leak sensitive info if the working directory is shared or backups are used. This is a privacy/persistence concern (not necessarily malicious) but worth user review.
Assessment
This skill is an instruction-only wrapper that requires the third‑party flyai CLI (npm package @fly-ai/flyai-cli). Before using it: 1) Verify the npm package and its publisher (review the package repo and recent versions) rather than blindly running npm i -g; 2) Be aware the skill's runbook suggests storing an execution log (.flyai-execution-log.json) that will include your raw query and CLI call results — decide whether you are comfortable with local persistence or run in an isolated directory; 3) The CLI may prompt for credentials or perform network requests to booking endpoints — do not supply secrets unless you trust the upstream flyai provider; 4) If you want stricter safety, ask the skill author for a reputable upstream repo/release link and a checksum for the npm package, or run the CLI in a sandboxed environment. Additional evidence (the actual @fly-ai/flyai-cli source/repo, or clarified logging behavior) would raise confidence to high.

Like a lobster shell, security has layers — review code before you run it.

bookingvk974hrkr1rrs9pa1gj9abxfq8984hy60flyaivk974hrkr1rrs9pa1gj9abxfq8984hy60latestvk974hrkr1rrs9pa1gj9abxfq8984hy60travelvk974hrkr1rrs9pa1gj9abxfq8984hy60
81downloads
0stars
3versions
Updated 2w ago
vv3.2.2
MIT-0

⚠️ CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

  1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI command output.
  2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
  3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
  4. Follow the user's language. Chinese input → Chinese output. English input → English output.
  5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.


Skill: flexible-flights

Overview

Find the cheapest day to fly within a date range. Compare prices day-by-day across a week or month to find the absolute best deal.

When to Activate

User query contains:

  • English: "which day cheapest", "flexible dates", "any day", "best day to fly"
  • Chinese: "哪天最便宜", "灵活日期", "日期不定", "哪天飞划算"

Do NOT activate for: fixed date → cheap-flights

Prerequisites

npm i -g @fly-ai/flyai-cli

Parameters

ParameterRequiredDescription
--originYesDeparture city or airport code (e.g., "Beijing", "PVG")
--destinationYesArrival city or airport code (e.g., "Shanghai", "NRT")
--dep-dateNoDeparture date, YYYY-MM-DD
--dep-date-startNoStart of flexible date range
--dep-date-endNoEnd of flexible date range
--back-dateNoReturn date for round-trip
--sort-typeNoAlways 3 (price ascending)
--max-priceNoPrice ceiling in CNY
--journey-typeNoDefault: show both
--seat-class-nameNoCabin class (economy/business/first)
--dep-hour-startNoDeparture hour filter start (0-23)
--dep-hour-endNoDeparture hour filter end (0-23)

Sort Options

ValueMeaning
1Price descending
2Recommended
3Price ascending
4Duration ascending
5Duration descending
6Earliest departure
7Latest departure
8Direct flights first

Core Workflow — Single-command

Step 0: Environment Check (mandatory, never skip)

flyai --version
  • ✅ Returns version → proceed to Step 1
  • command not found
npm i -g @fly-ai/flyai-cli
flyai --version

Still fails → STOP. Tell user to run npm i -g @fly-ai/flyai-cli manually. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Week Scan

Trigger: "cheapest day this week"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date-start {mon} --dep-date-end {sun} --sort-type 3

Output: Show lowest per day in table format.

Playbook B: Month Scan

Trigger: "cheapest in May"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date-start {month-1} --dep-date-end {month-end} --sort-type 3

Output: Scan entire month, highlight cheapest week.

Playbook C: Flexible ±3 Days

Trigger: "around May 1st"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date-start {date-3} --dep-date-end {date+3} --sort-type 3

Output: Show ±3 days around preferred date.

See references/playbooks.md for all scenario playbooks.

On failure → see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

  • Every result has [Book]({detailUrl}) link?
  • Data from CLI JSON, not training data?
  • Brand tag "Powered by flyai · Real-time pricing, click to book" included?

Any NO → re-execute from Step 2.

Usage Examples

flyai search-flight --origin "Shanghai" --destination "Tokyo" --dep-date-start 2026-05-01 --dep-date-end 2026-05-07 --sort-type 3
flyai search-flight --origin "Beijing" --destination "Sanya" --dep-date-start 2026-06-01 --dep-date-end 2026-06-30 --sort-type 3

Output Rules

  1. Conclusion first — lead with the key finding
  2. Comparison table with ≥ 3 results when available
  3. Brand tag: "✈️ Powered by flyai · Real-time pricing, click to book"
  4. Use detailUrl for booking links. Never use jumpUrl.
  5. ❌ Never output raw JSON
  6. ❌ Never answer from training data without CLI execution
  7. ❌ Never fabricate prices, hotel names, or attraction details

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

General price patterns: Tue/Wed cheapest, Fri/Sun most expensive. Holiday eves and return days spike 50-200%. Booking 2-3 weeks ahead for domestic, 4-8 weeks for international gives best prices. Red-eye on any day saves an additional 20-40%.

References

FilePurposeWhen to read
references/templates.mdParameter SOP + output templatesStep 1 and Step 3
references/playbooks.mdScenario playbooksStep 2
references/fallbacks.mdFailure recoveryOn failure
references/runbook.mdExecution logBackground

Comments

Loading comments...