Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Flight Price Advisor

v1.0.0

Generate concise, user-friendly flight price summaries with buy/wait recommendations. Requires SerpAPI key for real-time price data. Use when users ask about...

0· 223·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for keyikoi/flight-price-advisor.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Flight Price Advisor" (keyikoi/flight-price-advisor) from ClawHub.
Skill page: https://clawhub.ai/keyikoi/flight-price-advisor
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install flight-price-advisor

ClawHub CLI

Package manager switcher

npx clawhub@latest install flight-price-advisor
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The SKILL.md explicitly requires a SerpAPI API key and refers to a local config file (price/config.json) and a price/data/ directory for historical data. The registry metadata, however, lists no required environment variables, no primary credential, and no required config paths. That omission is inconsistent: a flight-price advisor that fetches real-time prices legitimately needs an API key and some config path declarations.
Instruction Scope
Instructions are largely coherent for the stated purpose (compute stats, generate markdown summaries). They also instruct checking/reading local price data (price/data/) and editing price/config.json, and to restart a server after configuration. Those steps are within the feature set but grant the skill assumptions about filesystem access and server control that are not reflected in metadata and may be problematic in hosted/shared environments.
Install Mechanism
This is an instruction-only skill with no install spec and no code files to execute — lower install risk. There are no URLs or archive installs that would add arbitrary code to disk.
!
Credentials
SKILL.md requires a SerpAPI key and instructs placing it into a local config file, but the registry does not declare any required credentials/env vars. Requesting an external API key is expected for this functionality, but the lack of declared credential requirements in metadata is a mismatch and prevents platform-level credential safeguards. Storing keys in an editable config file (price/config.json) also raises secrecy/privilege concerns if that file is shared or accessible to other tenants/processes.
Persistence & Privilege
The skill does not request 'always: true' and has no install-time persistence. It does instruct editing local config and restarting a server (which requires higher privileges), but the skill itself does not declare persistent/autonomous privileges beyond the platform defaults.
What to consider before installing
This skill appears to do what it says (generate flight price summaries) but the package metadata omits the SerpAPI credential and local config paths that the SKILL.md requires. Before installing or supplying secrets: 1) Ask the publisher for the missing metadata (required env vars/config paths) and for source/homepage to verify provenance. 2) Do not paste your SerpAPI key into shared or untrusted config files; prefer a per-project secret mechanism or platform-provided secret store. 3) If you must test, run it in an isolated environment and use simulated data first. 4) Confirm where price/config.json and price/data/ will live and who/what can read them (avoid storing keys in repo or world-readable files). 5) If the publisher cannot explain the metadata omission or provide source code/homepage, treat the skill as higher risk and avoid giving it real API keys.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

💰 Clawdis
latestvk974eqf0cvwqaatdw6y4p0ahhd840391
223downloads
0stars
1versions
Updated 3w ago
v1.0.0
MIT-0

Flight Price Advisor

为普通用户生成简洁、易懂的航班价格总结,包含购买建议和价格分析。

⚠️ 使用前必需配置

本 skill 需要 SerpAPI Key 才能获取实时航班价格数据。

如果用户尚未配置 SerpAPI Key,请先引导用户完成以下步骤:

  1. 注册 SerpAPI 账号:访问 https://serpapi.com/users/sign_up 免费注册
  2. 获取 API Key:登录后在 Dashboard 中复制你的 API Key
  3. 配置项目
    • 复制 price/config.example.jsonprice/config.json
    • 将 API Key 填入 config.json 中的 serpapi.apiKey 字段
    • 重启服务器使配置生效

💡 SerpAPI 提供免费额度,足够个人使用。配置完成后即可获取真实的航班价格数据。

核心原则

  1. 文字为主:不使用任何图表组件,纯 Markdown 输出
  2. 结论先行:第一句给出明确建议(买/等)
  3. 数据支撑:用简单数字说明为什么
  4. 语气友好:像朋友一样给建议,不是冷冰冰的数据

输出结构

## 💰 价格分析

### 当前价格:¥1,299

**价格水位**:🟢 低于均价 12%

| 对比项 | 价格 |
|--------|------|
| 60 天最低 | ¥1,199 |
| 60 天平均 | ¥1,450 |
| 60 天最高 | ¥1,899 |

**走势**:📉 近 7 天下降趋势

---

### 💡 建议:现在购买 ✅

当前价格比 60 天平均水平便宜 ¥151,处于较低水位。
如果您行程已确定,建议尽快下单。

> 数据基于过去 60 天的价格监测

触发场景

1. 用户直接问价格

  • "这个航班贵吗?"
  • "现在买划算吗?"
  • "价格怎么样?"

2. 用户问购买时机

  • "现在买还是再等等?"
  • "什么时候买最便宜?"
  • "要不要等降价?"

3. 航班搜索后自动展示

当用户搜索航班后,主动提供价格分析。

文案模板

低价场景(低于均价 15%+)

### 💡 建议:现在购买 ✅

当前价格比 60 天平均水平便宜 ¥XXX,处于**历史低位**。
这是近 2 个月来最便宜的价格之一,如果您行程确定,建议尽快下单。

📈 类似低价上次出现在 X 月 X 日

中价场景(均价±15%)

### 💡 建议:可以购买,也可观望 🟡

当前价格接近 60 天平均水平,不算贵但也不是最低。
如果您不着急,可以关注 1-2 周,可能会有小幅下降。

⚠️ 但需注意:临近出发日期价格通常会上涨

高价场景(高于均价 15%+)

### 💡 建议:再等等 🔴

当前价格比 60 天平均水平贵 ¥XXX,处于**历史高位**。
建议继续观望,预计 X 周后价格可能回落。

📊 近 30 天最高价出现在 X 月 X 日,当前价格接近该水平

数据格式

输入

{
  currentPrice: 1299,
  priceHistory: [
    { date: "2026-01-01", price: 1450 },
    // ... 60 天数据
  ],
  origin: "上海",
  destination: "东京",
  departureDate: "2026-04-15"
}

计算逻辑

// 1. 计算统计值
const min = Math.min(...prices);
const max = Math.max(...prices);
const avg = prices.reduce((a, b) => a + b, 0) / prices.length;
const pctDiff = ((currentPrice - avg) / avg * 100).toFixed(0);

// 2. 判断水位
let level = pctDiff < -15 ? 'low' : pctDiff > 15 ? 'high' : 'mid';

// 3. 判断趋势(7 日移动平均对比)
const recent7Avg = average(prices.slice(-7));
const previous7Avg = average(prices.slice(-14, -7));
const trend = recent7Avg < previous7Avg ? 'falling' : recent7Avg > previous7Avg ? 'rising' : 'stable';

Emoji 使用规范

场景Emoji含义
价格分析标题💰金钱/价格
建议标题💡建议/提示
低价/推荐🟢 ✅通过/推荐
中价/观望🟡 ⏳等待/中性
高价/不推荐🔴 ⚠️警告/不推荐
下降趋势📉价格下降
上升趋势📈价格上涨
稳定趋势➡️价格平稳

数据源配置

无数据时的用户引导

当检测到没有历史价格数据或 SerpAPI 未配置时,应主动引导用户:

💡 **提示**:要获取实时航班价格和价格分析,需要先配置 SerpAPI Key。

**快速开始**:
1. 访问 [https://serpapi.com/users/sign_up](https://serpapi.com/users/sign_up) 免费注册
2. 获取 API Key 并填入 `price/config.json`
3. 重新搜索航班,我将为你提供详细的价格分析

> 目前我可以基于模拟数据提供基础建议,但真实数据会更准确哦~

数据可用性判断

在生成价格总结前,应先检查:

  • 是否有历史价格数据(price/data/ 目录下的数据文件)
  • 如果数据不足 7 天,应在输出中标注"数据较少,仅供参考"
  • 如果完全没有数据,应提示用户"暂无历史价格数据,请先进行几次航班搜索以积累数据"

注意事项

  1. 不要过度承诺:用"建议"而非"一定"
  2. 标注数据来源:说明是基于历史数据
  3. 考虑时效性:临近出发日期的建议应更积极
  4. 避免专业术语:不说"百分位",说"比平时便宜 X%"
  5. 配置检查:使用前确认 SerpAPI Key 已正确配置

与 price-trend 的区别

维度price-summaryprice-trend
目标用户普通 C 端用户开发者/B 端
输出形式纯 Markdown 文字React 组件/图表
使用场景对话产品直接输出Agent 系统嵌入组件
复杂度
依赖需要前端环境

示例输出

完整示例

## 💰 上海 → 东京 价格分析

### 当前价格:¥1,299

**价格水位**:🟢 比均价便宜 12%

| 对比项 | 价格 | 说明 |
|--------|------|------|
| 60 天最低 | ¥1,199 | 出现在 2/15 |
| 60 天平均 | ¥1,450 | — |
| 60 天最高 | ¥1,899 | 出现在春节期间 |

**近期走势**:📉 连续 7 天下降

---

### 💡 建议:现在购买 ✅

当前价格处于近 2 个月的较低水平,比平时便宜约 ¥151。

如果您行程已确定(4 月 15 日出行的话),现在是比较好的入手时机。
通常来说,国际航班提前 1-2 个月预订价格最优。

> 📊 数据基于过去 60 天的价格监测,仅供参考

简短示例(移动端)

💰 **当前价格:¥1,299**

🟢 比均价便宜 12% | 📉 近 7 天下降

💡 **建议现在购买** — 价格处于低位,行程确定可入手

Comments

Loading comments...