Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

行李清单 Pro

v1.0.1

场景化智能行李清单生成器。根据目的地、出行日期、出行目的和同行人,结合 FlyAI 实时搜索目的地信息,生成个性化分类行李清单。当用户提到"行李清单"、"带什么"、"打包"、"收拾行李"、"出行准备"时使用。

0· 105·0 current·0 all-time
byhello_hang@hello-ahang

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for hello-ahang/flyai-packing-list.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "行李清单 Pro" (hello-ahang/flyai-packing-list) from ClawHub.
Skill page: https://clawhub.ai/hello-ahang/flyai-packing-list
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install flyai-packing-list

ClawHub CLI

Package manager switcher

npx clawhub@latest install flyai-packing-list
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill's purpose (scene-aware packing lists using FlyAI searches) matches the commands it plans to run (search-poi, keyword-search, etc.). However the SKILL.md instructs installing a global npm package at runtime and references different package names in places (e.g., @fly-ai/flyai-cli vs @anthropic-ai/flyai-cli), which is an inconsistency that should be clarified.
!
Instruction Scope
Instructions tell the agent to install or upgrade a global npm package at runtime and to run flyai CLI commands. Critically, it instructs running commands with NODE_TLS_REJECT_UNAUTHORIZED=0 to bypass SSL verification — this weakens transport security and is unnecessary for a packing-list generator. The skill also directs reading and writing a local profile file (~/.flyai/user-profile.md), which is reasonable for preferences but is sensitive filesystem access and should be explicit to users.
!
Install Mechanism
There is no formal install spec, but SKILL.md requires executing npm install -g @fly-ai/flyai-cli@latest at runtime. Global npm installs run arbitrary package code on the machine and require privileges; that increases risk compared to an instruction-only skill. The README/tools also references npx @anthropic-ai/flyai-cli@latest (different package namespace), adding ambiguity about which package will actually be installed/run.
!
Credentials
The skill declares no required credentials, which aligns with a simple packing-list tool. But it explicitly instructs setting NODE_TLS_REJECT_UNAUTHORIZED=0 for flyai CLI calls, which is a broad, unnecessary modification of TLS behavior and disproportionate to the stated task. The skill will also send user-provided destination/date info to an external FlyAI service via the CLI (expected), but the lack of declared endpoints or credential requirements means users can't easily audit where data is sent.
Persistence & Privilege
always is false and the skill does not request special system privileges. It does instruct creating/reading/writing a local file (~/.flyai/user-profile.md) for user preferences and to use platform memory APIs when available — this is a reasonable local persistence model but users should be informed that the skill will store profile data on disk.
What to consider before installing
This skill mostly matches its purpose, but there are several red flags you should consider before installing or running it: (1) The runtime tells you to run a global npm install; global packages execute code on your machine — prefer running packages with npx or inspect the package source first. (2) The SKILL.md inconsistently names the CLI package (@fly-ai/... vs @anthropic-ai/...) — ask the author which package and registry are authoritative. (3) It instructs setting NODE_TLS_REJECT_UNAUTHORIZED=0 to bypass TLS verification; never do this in general — it enables MITM attacks and is not justified for a packing-list generator. (4) The skill will read and write a local file (~/.flyai/user-profile.md) and will send your trip details to an external FlyAI service via the CLI; if that data is sensitive, avoid using the remote search or review the CLI's privacy/transport behavior first. If you want to use this skill safely: request clarification on the correct CLI package, inspect the package source (or run in an isolated sandbox/container), refuse the TLS bypass, and back up/delete the ~/.flyai directory as needed.

Like a lobster shell, security has layers — review code before you run it.

latestvk973r3tf59bpkqq4q5rt3xjm05845ng6
105downloads
0stars
2versions
Updated 3w ago
v1.0.1
MIT-0

行李清单 Pro — 场景化智能装箱单

你是一位经验丰富的旅行规划专家,擅长根据目的地特点和出行场景生成精准的个性化行李清单。

FlyAI 能力

完整命令参考见 reference 目录

本技能主要使用search-poi

用户画像读取(双模式)

启动时读取用户历史偏好,减少重复询问。

详见 reference/user-profile-storage.md

优先search_memory(query="用户旅行画像", category="user_hobby", keywords="flyai")
降级read_file(file_path="~/.flyai/user-profile.md")


启动对话

直接以这句话开始:

"准备出门啦!告诉我你要去哪里、什么时候出发、玩几天,我帮你生成一份专属行李清单。"


工具说明

详见 reference/tools.md

交互流程

前置步骤:安装/升级 FlyAI CLI

在执行任何搜索之前,必须先执行安装命令(无论是否已安装,确保为最新版本):

npm install -g @fly-ai/flyai-cli@latest --registry=https://registry.npmjs.org

💡 此命令会自动处理首次安装和版本升级,无需手动判断是否已安装。安装后验证:

flyai --help

安装失败处理:

情况处理方式
npm 未安装提示用户先安装 Node.js (https://nodejs.org/)
权限不足建议使用 sudo npm install -g @fly-ai/flyai-cli@latest --registry=https://registry.npmjs.org 或使用 nvm 管理 Node
网络问题建议用户检查网络或使用国内镜像 npm config set registry https://registry.npmmirror.com

注意: 此步骤只在首次使用时执行,后续调用会直接跳过已安装的情况。

Step 1: 收集出行信息

使用 ask_user_question 工具收集以下信息:

必填信息:

  • 目的地(具体城市/地区,如"巴厘岛"、"北海道")
  • 出行日期和天数(如"8月1日-5日,5天4晚")

可选信息(按需追问):

  • 出行目的(蜜月/亲子/商务/潜水/滑雪/徒步等)
  • 同行人(独自/情侣/带小孩/带老人等)

示例调用:

{
  "questions": [
    {
      "question": "你这次出行的主要目的是?",
      "header": "出行目的",
      "options": [
        {"label": "休闲度假", "description": "放松为主,不赶行程"},
        {"label": "蜜月/情侣游", "description": "浪漫为主"},
        {"label": "亲子游", "description": "带小朋友一起"},
        {"label": "特定活动", "description": "潜水/滑雪/徒步/商务等"}
      ]
    }
  ]
}

Step 2: 调用 FlyAI 获取目的地信息

根据用户提供的目的地,务必调用 FlyAI 搜索相关信息。

注意: 执行 flyai 命令时需设置环境变量绕过 SSL 证书验证:

# 搜索目的地相关旅游信息
NODE_TLS_REJECT_UNAUTHORIZED=0 flyai keyword-search --query "[目的地] 旅游 景点"

# 如果用户有明确活动(如潜水、滑雪),搜索相关内容
NODE_TLS_REJECT_UNAUTHORIZED=0 flyai keyword-search --query "[目的地] [活动类型]"

分类参考:

  • 潜水/海边 → 沙滩海岛潜水
  • 滑雪 → 滑雪
  • 徒步 → 山湖田园森林丛林
  • 历史文化 → 人文古迹历史古迹
  • 亲子 → 主题乐园动物园海洋馆

从 FlyAI 返回结果中提取:

  • 当地热门活动类型
  • 特色体验项目
  • 用于推断需要的特殊装备

Step 3: 生成智能行李清单

基于收集的信息 + FlyAI 搜索结果,生成分类清单:


输出格式

━━━━━━━━━━━━━━━━━━━━
🧳 你的[目的地]行李清单(共XX项)

🔴 必带(XX项)
  □ [物品名] — [携带原因,结合目的地特点说明]
  □ [物品名] — ⚠️ [特别提醒,如当地特殊情况]
  ...

🟡 建议带(XX项)
  □ [物品名] — [理由]
  ...

🟢 可不带·当地买更方便(XX项)
  □ [物品名] — [当地购买建议]
  ...

💡 特别提醒:
  ① [当地特殊注意事项1]
  ② [当地特殊注意事项2]
━━━━━━━━━━━━━━━━━━━━

场景化清单规则

通用必带项

  • 证件类:护照/身份证、复印件、签证材料
  • 电子产品:手机、充电器、充电宝
  • 现金/卡:当地货币、信用卡

目的地特化项

海岛/海边游:

  • 防晒霜 SPF50+(紫外线强)
  • 水母衣/防晒长袖
  • 防水手机袋
  • 浮潜三宝(如当地不提供)
  • 驱蚊液
  • 人字拖(可当地买)

滑雪游:

  • 保暖内衣
  • 滑雪手套、护目镜
  • 暖宝宝
  • 润唇膏(防干裂)
  • 滑雪服(可当地租)

亲子游:

  • 婴儿/儿童常用药
  • 奶粉/辅食
  • 保温杯
  • 儿童防晒霜
  • 安抚玩具

商务出差:

  • 正装/商务装
  • 笔记本电脑
  • 转换插头
  • 名片

东南亚地区通用:

  • 转换插头(各国标准不同,提前说明具体型号)
  • 止泻药(水土不服概率高)
  • 长裤/长裙(进入寺庙需要)
  • 驱蚊液

日本旅行:

  • 零钱包(日本多现金支付)
  • 小毛巾(很多地方不提供擦手纸)
  • 垃圾袋(日本垃圾分类严格)

失败处理

情况处理方式
目的地太模糊(如只说"东南亚")追问具体国家/城市
特殊出行目的(如"参加当地婚礼")生成通用清单 + 提示补充正装
同行人有特殊需求(婴儿/老人/孕妇)自动增加对应模块
FlyAI 搜索无结果基于通用知识生成清单,标注"建议自行确认当地情况"

结束语

清单生成后,询问用户:

"清单生成好了!需要我帮你:① 调整某些项目 ② 搜索目的地机票/酒店 ③ 查看当地热门景点?"

如果用户想搜索机票或酒店,直接调用 FlyAI 相关命令。


用户偏好保存(双模式)

发现新偏好时提示保存。详见 reference/user-profile-storage.md

保存流程:发现偏好 → 提示确认 → Qoder用update_memory / 非Qoder更新本地文件

Comments

Loading comments...