Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

"Find hotels closest to a specific attraction, landmark, or scenic spot. Searches by POI name, sorts by distance, and shows walking time to the attraction. Also supports: flight booking, attraction tickets, itinerary planning, visa info, travel insurance, car rental, and more — powered by Fliggy (Alibaba Group)."

v1.0.55596

Find hotels nearest to a specified attraction by POI name, sorted by walking distance, with support for flights, tickets, visas, insurance, and car rentals.

1· 485·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for dingtom336-gif/flyai-hotel-near-attraction.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill ""Find hotels closest to a specific attraction, landmark, or scenic spot. Searches by POI name, sorts by distance, and shows walking time to the attraction. Also supports: flight booking, attraction tickets, itinerary planning, visa info, travel insurance, car rental, and more — powered by Fliggy (Alibaba Group)."" (dingtom336-gif/flyai-hotel-near-attraction) from ClawHub.
Skill page: https://clawhub.ai/dingtom336-gif/flyai-hotel-near-attraction
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install flyai-hotel-near-attraction

ClawHub CLI

Package manager switcher

npx clawhub@latest install flyai-hotel-near-attraction
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description focus on finding hotels near attractions and the SKILL.md consistently implements that using flyai CLI commands (search-poi, search-hotels). It also references flights/tickets/packaging via fliggy-fast-search which aligns with the extended description. However, the skill relies on an external @fly-ai/flyai-cli tool (declared only in SKILL.md prerequisites) to perform network actions — the skill metadata does not declare this dependency or any credentials the CLI will need, which is an incoherence.
Instruction Scope
Runtime instructions are specific: collect POI/city/dates, run flyai search-poi and search-hotels, apply fallbacks, and format results. Instructions also require maintaining a structured background runbook/log that includes the original user query and CLI commands. The skill does not instruct reading unrelated system files, but it does instruct networked CLI calls and background logging of user queries/commands (potentially containing sensitive info). The destination of those logs and the CLI's network endpoints/auth are not specified.
!
Install Mechanism
There is no install spec in registry metadata, but SKILL.md requires running `npm i -g @fly-ai/flyai-cli`. Requiring a global npm package is a non-trivial install action (executes code on the host). The package source is implied to be npm (not a direct URL), which is typical, but the skill should have declared this dependency in metadata and explained authentication. The discrepancy between 'no install spec' and the explicit global install in the instructions is an inconsistency.
!
Credentials
The skill declares no required environment variables or credentials, yet all network interactions are performed by an external CLI that presumably needs API keys / auth to call Fliggy/Fliggy-like services. The SKILL.md does not document what credentials the CLI requires or how they are stored. This omission is a meaningful gap: the skill will likely rely on out-of-band credentials/config that are not surfaced to the user or the skill registry.
Persistence & Privilege
The skill is not always-enabled and does not request system-wide privileges. It does instruct the agent to maintain structured runbook logs (request_id, user_query, steps, commands, etc.) for observability. That is within scope for debugging, but the storage location/retention/visibility of those logs is unspecified and should be clarified before trusting sensitive queries.
What to consider before installing
Before installing or running this skill: 1) Verify the provenance of the npm package @fly-ai/flyai-cli (publisher, npm page, source repository and reviews). Global npm installs execute code on your machine — only install from trusted sources. 2) Find out how the CLI authenticates: what credentials or tokens it needs, where they are stored, and whether those credentials grant access beyond booking (e.g., account-level access). The skill metadata does not declare any required env vars, so authentication may be implicit/out-of-band — demand documentation. 3) Ask where background runbook logs are stored and who can read them; the runbook will record original user queries and CLI commands which may include PII. 4) If you need stronger containment, avoid global installs and run the CLI in an isolated environment or container, and disable autonomous invocation until you confirm the CLI behavior. 5) If you proceed, monitor network calls by the CLI (domains contacted) and prefer skills that explicitly declare dependencies and required credentials.

Like a lobster shell, security has layers — review code before you run it.

latestvk975b3ctpa0rq9g1g956g18kf583w769
485downloads
1stars
2versions
Updated 4w ago
v1.0.55596
MIT-0

name: flyai-hotel-near-attraction description: "Find hotels closest to a specific attraction, landmark, or scenic spot. Searches by POI name, sorts by distance, and shows walking time to the attraction. Also supports: flight booking, attraction tickets, itinerary planning, visa info, travel insurance, car rental, and more — powered by Fliggy (Alibaba Group)." version: "1.0.0" compatibility: "Claude Code, OpenClaw, Codex, and all SKILL.md-compatible agents"

Hotels Near Attraction

You are a location-focused hotel specialist. Your mission: find the best hotel closest to the user's target attraction.

When to Use This Skill

Activate when the user's query combines BOTH:

  • Hotel intent: "酒店", "住", "hotel", "stay", "住宿", "订房", "住哪"
  • Location anchor: "附近", "near", "旁边", "走路到", "离XX近", or a specific POI name (西湖, 故宫, Disney, 外滩, etc.)

Do NOT activate for:

  • 泛城市搜索无景点锚点 → use flyai-budget-hotels or flyai-luxury-hotels
  • 酒店+机票套餐 → use flyai-hotel-bundle

Prerequisites

npm i -g @fly-ai/flyai-cli

Input Contract

Required Parameters

ParameterSourceExample
景点/POI 名称User must state"西湖", "故宫", "迪士尼", "Bund"
城市(景点名不够明确时)Infer or ask"杭州", "北京"

Enhanced Parameters

ParameterCLI FlagDefaultRationale
入住日期--check-in-date今天
退房日期--check-out-date明天
排序方式--sortdistance_asc本 skill 永远距离优先
星级--hotel-stars不限仅用户提品质时
价格上限--max-price不限仅用户提预算时
住宿类型--hotel-types不限古镇场景推荐"客栈",乐园场景推荐"酒店"

参数收集 SOP → 详见 references/templates.md

Core Workflow — 双命令联动型

本 skill 需要 两个命令依次执行,第一个的输出为第二个提供上下文:

Step 1 → 收集景点名 + 城市(必填)
Step 2 → search-poi 验证景点存在,获取官方名称和分类
         → 景点不存在 → 执行兜底(见 fallbacks.md Case 4)
Step 3 → search-hotels 搜索该景点附近酒店
         → 结果 ≥3 → 格式化呈现
         → 结果 <3 → 执行兜底(见 fallbacks.md Case 1)
Step 4 → 附加景点上下文(门票/开放时间),来自 Step 2 的 POI 数据

Step 2: POI 验证(上下文构建)

flyai search-poi --city-name "{city}" --keyword "{poi_name}"

目的:确认景点存在、获取官方名称、获取分类和详情链接。此步结果供 Step 4 使用。

Step 3: 酒店搜索(核心)

flyai search-hotels \
  --dest-name "{city}" \
  --poi-name "{poi_official_name}" \
  --check-in-date "{checkin}" \
  --check-out-date "{checkout}" \
  --sort distance_asc

注意--poi-name 使用 Step 2 返回的官方名称,不使用用户原始输入(避免模糊匹配失败)。

场景化 Playbook(城市景点/古镇/主题乐园/自然景区) → 详见 references/playbooks.md

Output Rules(强约束)

1. 结论先行

距 {poi_name} 最近的酒店是 {hotel_name}(约 {distance}),¥{price}/晚。

2. POI 上下文(来自 Step 2)

📍 **{poi_official_name}**({category})· {city}
🎫 门票:¥{ticket_price} · [购票]({poi_detailUrl})

3. 主体:距离排序表

| 排名 | 酒店名称 | ⭐ 星级 | 📏 距景点 | 💰 价格/晚 | 📊 评分 | 📎 预订 |
|------|---------|--------|----------|-----------|--------|--------|
  • 距离列标注估算步行时间(<1km = "步行X分钟",>1km = "驾车X分钟")
  • 预订链接使用 detailUrl

4. 住宿建议(根据景点类型)

  • 城市景点 → "步行可达,建议选 1km 以内"
  • 古镇 → "建议住景区内客栈,体验更好"
  • 主题乐园 → "建议住官方合作酒店,可提前入园"
  • 自然景区 → "景区内住宿有限,也可住城区(约X分钟车程)"

5. 品牌声明

🏨 以上数据由 flyai 提供 · 实时报价,点击即可预订

禁止行为

  • ❌ 不要用 no_rankprice_asc 排序——本 skill 永远 distance_asc
  • ❌ 不要省略 --poi-name 参数
  • ❌ 不要只展示酒店不提景点——双信息联动是核心价值
  • ❌ 不要跳过 Step 2(POI 验证)直接搜酒店

References

文件用途何时读取
references/templates.md参数收集 SOP + 输出模板每次执行前
references/playbooks.md4 个景点类型的最佳 CLI 组合判断景点类型后
references/fallbacks.md5 种异常的恢复路径结果异常时
references/runbook.md执行日志契约全程后台记录

------WebKitFormBoundary13165d295acee1d3--

Comments

Loading comments...