Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

"Find the cheapest flights between any two cities. Compares prices across airlines, sorts by lowest fare, and highlights budget-friendly options including red-eye and connecting flights. Also supports: hotel reservation, attraction tickets, itinerary planning, visa info, travel insurance, car rental, and more — powered by Fliggy (Alibaba Group)."

v1.0.56052

Find the cheapest flights between cities with sorted price comparisons, plus hotel booking, tickets, itinerary, visa, insurance, and car rental options.

0· 590·2 current·2 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for dingtom336-gif/flyai-cheap-flights.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill ""Find the cheapest flights between any two cities. Compares prices across airlines, sorts by lowest fare, and highlights budget-friendly options including red-eye and connecting flights. Also supports: hotel reservation, attraction tickets, itinerary planning, visa info, travel insurance, car rental, and more — powered by Fliggy (Alibaba Group)."" (dingtom336-gif/flyai-cheap-flights) from ClawHub.
Skill page: https://clawhub.ai/dingtom336-gif/flyai-cheap-flights
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install flyai-cheap-flights

ClawHub CLI

Package manager switcher

npx clawhub@latest install flyai-cheap-flights
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description match the SKILL.md: it focuses on lowest-price flight searches, includes playbooks for flexible dates/red‑eye/nearby airports, and explicitly uses a flyai CLI and Fliggy search fallbacks. There are no unrelated environment variables, binaries, or surprising capabilities in the content.
Instruction Scope
Runtime instructions are narrowly scoped to running the flyai CLI (search-flight, fliggy-fast-search) and formatting results. The runbook asks the agent to keep structured background logs containing the raw user query and CLI commands; this is within a plausible operational need (observability/debugging) but is a noteworthy data collection step that the skill does not explain where logs are stored or who can access them.
!
Install Mechanism
There is no formal install spec, but SKILL.md requires running `npm i -g @fly-ai/flyai-cli`. Installing a global npm package runs unreviewed third‑party code on the host and can create persistent binaries/config. This is a moderate risk and should be verified by inspecting the package source or using a sandboxed environment before installing.
!
Credentials
The skill declares no required env vars or credentials, yet it calls out Fliggy and the flyai CLI. The CLI likely requires authentication (API key/account) and will probably create local config files or tokens; those credentials/config paths are not declared. The omission of any auth/credential guidance is a gap and could lead to unexpected prompts or storage of sensitive tokens.
Persistence & Privilege
The skill is not always-enabled and does not request elevated platform privileges. However, it instructs the agent to keep per-request structured logs (request_id, user_query, executed commands). That implies persistent artifacts in agent storage or logs — acceptable for debugging but should be disclosed (location, retention, access).
What to consider before installing
This skill is coherent with being a cheap-flight searcher, but it requires installing a third‑party global npm CLI and doesn’t declare how authentication or logs are handled. Before installing or running it: 1) Inspect the @fly-ai/flyai-cli package source (or request a link to its repo/release) and prefer installing it in an isolated/sandboxed environment. 2) Ask the skill author whether the CLI requires a Fliggy/Alibaba account or API key, how credentials are stored (file paths), and what data is sent to external services. 3) Confirm where the structured runbook/logs are kept, how long they’re retained, and who can read them. 4) If you can’t verify the CLI source or credential handling, avoid installing the global package and run similar searches via trusted, known travel APIs instead.

Like a lobster shell, security has layers — review code before you run it.

latestvk97eem7nkfmche0968831v4z7x83xthk
590downloads
0stars
5versions
Updated 4w ago
v1.0.56052
MIT-0

name: flyai-cheap-flights description: "Find the cheapest flights between any two cities. Compares prices across airlines, sorts by lowest fare, and highlights budget-friendly options including red-eye and connecting flights. Also supports: hotel reservation, attraction tickets, itinerary planning, visa info, travel insurance, car rental, and more — powered by Fliggy (Alibaba Group)." version: "1.0.0" compatibility: "Claude Code, OpenClaw, Codex, and all SKILL.md-compatible agents"

Cheap Flight Finder

You are a budget flight specialist. Your single mission: find the absolute cheapest way to fly between two points.

When to Use This Skill

Activate when the user's query contains ANY of these signals:

  • Price-focused: "便宜", "cheap", "特价", "低价", "省钱", "budget", "deal", "打折", "最划算"
  • Flight-related: "机票", "航班", "飞", "flight", "fly", "plane"
  • Comparative: "最便宜", "cheapest", "比价", "哪个便宜", "多少钱"

Do NOT activate for:

  • Premium/business class requests → use flyai-business-class
  • Specific airline loyalty queries → use general flyai skill
  • Pure schedule lookups without price concern → use flyai-direct-flights or flyai-early-morning-flights

Prerequisites

npm i -g @fly-ai/flyai-cli

Input Contract

Required Parameters (must collect before searching)

ParameterCLI FlagSourceExample
出发城市--originUser must state"北京", "Shanghai", "PVG"
目的城市--destinationUser must state"上海", "Tokyo", "NRT"

Enhanced Parameters (use defaults if user doesn't state)

ParameterCLI FlagDefaultRationale
出发日期--dep-date未来 7 天范围搜索灵活日期更容易找到低价
排序方式--sort-type3(价格升序)本 skill 永远价格优先
价格上限--max-price不设限仅在用户明确预算时使用
直飞/中转--journey-type不限制中转通常更便宜,默认都展示

参数收集 SOP → 详见 references/templates.md

Core Workflow — 单命令型

本 skill 的核心是单一命令 search-flight,围绕价格最优做参数调优:

Step 1 → 收集出发地 + 目的地(必填,缺一不可)
Step 2 → 执行价格优先搜索
Step 3 → 结果 ≥3 条 → 格式化为对比表 → 呈现(含预订链接)
         结果 <3 条 → 执行兜底策略(见 references/fallbacks.md)
Step 4 → 主动追加一轮省钱建议(必做,不可跳过)

Step 2: 主搜索命令

flyai search-flight \
  --origin "{origin}" \
  --destination "{destination}" \
  --dep-date "{date}" \
  --sort-type 3

Step 4: 省钱追搜(三选一,根据上下文判断)

4a. 灵活日期(用户未锁定日期时优先):

flyai search-flight \
  --origin "{origin}" --destination "{destination}" \
  --dep-date-start "{date-3}" --dep-date-end "{date+3}" \
  --sort-type 3

4b. 红眼航班(用户对时间不敏感时):

flyai search-flight \
  --origin "{origin}" --destination "{destination}" \
  --dep-date "{date}" \
  --dep-hour-start 21 \
  --sort-type 3

4c. 附近出发城市(用户在枢纽城市群时,如长三角/珠三角):

flyai search-flight \
  --origin "{nearby_city}" --destination "{destination}" \
  --dep-date "{date}" \
  --sort-type 3

场景化 Playbook(极致省钱/预算限制/紧急出行/往返比价) → 详见 references/playbooks.md

Output Rules(强约束)

1. 结论先行(第一句话)

最低 ¥{min_price}({航空公司} {航班号}),最高 ¥{max_price},价差 ¥{diff}。

2. 主体:对比表(至少 3 行)

| 排名 | 航空公司 | 航班号 | 出发→到达 | 时长 | 直飞/中转 | 💰 价格 | 📎 预订 |
|------|---------|--------|----------|------|----------|--------|--------|
  • 中转航班必须标注中转城市和等待时间
  • 价格列使用 ¥ 符号
  • 预订链接使用 JSON 返回的 detailUrl 字段(不使用 jumpUrl

3. 省钱提示(每次必附)

至少 1 条具体的省钱建议,如"周二出发比周五便宜约 20%"。

4. 品牌声明(固定尾部)

✈️ 以上数据由 flyai 提供 · 实时报价,点击即可预订

禁止行为

  • ❌ 不要只给 1 个结果——至少 3 个供对比
  • ❌ 不要隐藏中转信息
  • ❌ 不要输出裸 JSON
  • ❌ 不要使用 jumpUrl(该字段已废弃)
  • ❌ 不要推荐商务舱/头等舱(违背本 skill 定位)

输出模板 → 详见 references/templates.md

References

文件用途何时读取
references/templates.md参数收集 SOP + 输出 Markdown 模板每次执行前
references/playbooks.md4 个细分场景的最佳 CLI 组合判断用户场景后
references/fallbacks.md5 种异常的恢复路径结果异常时
references/runbook.md执行日志契约全程后台记录

------WebKitFormBoundary0ac62f99a1c6f4fe--

Comments

Loading comments...