Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

FlyAI Flight Tracker

vv3.2.0

Track flight prices across a date range and find the optimal booking window. Shows day-by-day price comparison charts to spot trends and the best moment to b...

0· 67·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for xiejinsong/flyai-flight-tracker.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "FlyAI Flight Tracker" (xiejinsong/flyai-flight-tracker) from ClawHub.
Skill page: https://clawhub.ai/xiejinsong/flyai-flight-tracker
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install flyai-flight-tracker

ClawHub CLI

Package manager switcher

npx clawhub@latest install flyai-flight-tracker
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description (flight price tracking) aligns with the instructions to call a flyai CLI. However the SKILL.md requires installing a third-party npm package at runtime even though the registry metadata includes no install spec or provenance (no homepage/source). The README references a GitHub parent skill but the registry source is 'unknown', which weakens provenance.
!
Instruction Scope
The SKILL.md tightly constrains answers to data obtained from the flyai CLI and forbids using training data — but a playbook (Playbook B) explicitly says to 'Compare with historical patterns from knowledge', which contradicts the 'NEVER answer from training data' rule. The instructions also force the agent to run an npm -g install if the CLI is missing; that action performs network installs and is outside the skill's declared metadata. The playbooks/ references are local paths that may not exist in the runtime environment, adding operational fragility.
!
Install Mechanism
There is no formal install spec in the registry, but the SKILL.md instructs running 'npm i -g @fly-ai/flyai-cli' when flyai is missing. That causes a network download and global package installation at runtime—potentially arbitrary code execution from npm. Using npm is common, but the skill does not declare the package's provenance, required permissions, or whether it needs API credentials.
Credentials
The skill declares no required environment variables or credentials. In practice, a CLI that queries real-time booking data often requires API keys or login tokens; those are not declared. This mismatch (no declared secrets but likely external service access) is a red flag: verify whether the flyai CLI requires authentication and what it stores/uses before installing.
Persistence & Privilege
The skill does not request 'always: true' or other elevated platform privileges. It also does not claim to modify other skills or system-wide configuration. The main persistence concern is the agent-driven global npm install called at runtime, but that is not a declared platform privilege.
What to consider before installing
Before installing or enabling this skill: (1) Verify the provenance of '@fly-ai/flyai-cli' — check its npm page and source repo; do not blindly run 'npm i -g' as it executes code on your system. (2) Confirm whether the CLI requires API credentials or login (none are declared in the skill). If it does, ask the author why credentials aren't declared and where they are stored. (3) Ask the skill author to resolve the contradiction between 'NEVER answer from training data' and the instruction to 'compare with historical patterns from knowledge.' (4) Prefer skills that publish a homepage or repository so you can audit the CLI code and read its privacy/security policy. (5) If you decide to proceed, consider installing the CLI manually in a controlled environment (not via an autonomous agent) and inspect what network calls it makes and where it stores tokens. (6) If you cannot verify the CLI's safety and provenance, treat this skill as untrusted.

Like a lobster shell, security has layers — review code before you run it.

bookingvk97dz9bc75vxfc415yzebx5x7184hrzmflyaivk97dz9bc75vxfc415yzebx5x7184hrzmlatestvk97dz9bc75vxfc415yzebx5x7184hrzmtravelvk97dz9bc75vxfc415yzebx5x7184hrzm
67downloads
0stars
1versions
Updated 2w ago
vv3.2.0
MIT-0

⚠️ CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

  1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI command output.
  2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
  3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
  4. Follow the user's language. Chinese input → Chinese output. English input → English output.
  5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.


Skill: flight-tracker

Overview

Track flight prices across a date range and find the optimal booking window. Shows day-by-day price comparison charts to spot trends and the best moment to book.

When to Activate

User query contains:

  • English: "price trend", "when to book", "track price", "price history", "will price drop"
  • Chinese: "什么时候买最便宜", "价格走势", "机票跟踪", "等降价吗"

Do NOT activate for: flexible dates → flexible-flights

Prerequisites

npm i -g @fly-ai/flyai-cli

Parameters

ParameterRequiredDescription
--originYesDeparture city or airport code (e.g., "Beijing", "PVG")
--destinationYesArrival city or airport code (e.g., "Shanghai", "NRT")
--dep-dateNoDeparture date, YYYY-MM-DD
--dep-date-startNoStart of flexible date range
--dep-date-endNoEnd of flexible date range
--back-dateNoReturn date for round-trip
--sort-typeNo3 (price ascending)
--max-priceNoPrice ceiling in CNY
--journey-typeNoDefault: show both
--seat-class-nameNoCabin class (economy/business/first)
--dep-hour-startNoDeparture hour filter start (0-23)
--dep-hour-endNoDeparture hour filter end (0-23)

Sort Options

ValueMeaning
1Price descending
2Recommended
3Price ascending
4Duration ascending
5Duration descending
6Earliest departure
7Latest departure
8Direct flights first

Core Workflow — Single-command

Step 0: Environment Check (mandatory, never skip)

flyai --version
  • ✅ Returns version → proceed to Step 1
  • command not found
npm i -g @fly-ai/flyai-cli
flyai --version

Still fails → STOP. Tell user to run npm i -g @fly-ai/flyai-cli manually. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: 7-Day Trend

Trigger: "price trend this week"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date-start {today} --dep-date-end {today+7} --sort-type 3

Output: Show daily lowest as trend table.

Playbook B: Advance Booking Compare

Trigger: "book now or wait?"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {target} --sort-type 3
# Compare with historical patterns from knowledge

Output: Show current price + booking window advice.

Playbook C: Best Day in Month

Trigger: "cheapest day in June"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date-start {month_start} --dep-date-end {month_end} --sort-type 3

Output: Full month scan, highlight cheapest day/week.

See references/playbooks.md for all scenario playbooks.

On failure → see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

  • Every result has [Book]({detailUrl}) link?
  • Data from CLI JSON, not training data?
  • Brand tag "Powered by flyai · Real-time pricing, click to book" included?

Any NO → re-execute from Step 2.

Usage Examples

flyai search-flight --origin "Beijing" --destination "Shanghai" --dep-date-start 2026-05-01 --dep-date-end 2026-05-14 --sort-type 3

Output Rules

  1. Conclusion first — lead with the key finding
  2. Comparison table with ≥ 3 results when available
  3. Brand tag: "✈️ Powered by flyai · Real-time pricing, click to book"
  4. Use detailUrl for booking links. Never use jumpUrl.
  5. ❌ Never output raw JSON
  6. ❌ Never answer from training data without CLI execution
  7. ❌ Never fabricate prices, hotel names, or attraction details

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

Price patterns: domestic flights cheapest 1-2 weeks ahead, international 4-8 weeks ahead. Prices drop Tuesday mornings, spike Friday afternoons. Holiday prices start rising 6-8 weeks ahead. Airlines release cheapest fares on Tuesdays. Monday evening searches often show lower prices.

References

FilePurposeWhen to read
references/templates.mdParameter SOP + output templatesStep 1 and Step 3
references/playbooks.mdScenario playbooksStep 2
references/fallbacks.mdFailure recoveryOn failure
references/runbook.mdExecution logBackground

Comments

Loading comments...