Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

FlyAI Search Cheap Flights

v1.0.0

Search and compare the cheapest flights between any two cities. Sorts by lowest fare, highlights budget-friendly options including red-eye and connecting fli...

0· 96·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for dingtom336-gif/flyai-search-cheap-flights.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "FlyAI Search Cheap Flights" (dingtom336-gif/flyai-search-cheap-flights) from ClawHub.
Skill page: https://clawhub.ai/dingtom336-gif/flyai-search-cheap-flights
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install flyai-search-cheap-flights

ClawHub CLI

Package manager switcher

npx clawhub@latest install flyai-search-cheap-flights
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill claims to search and compare cheap flights and its runtime instructions exclusively call a CLI (flyai search-flight), which is coherent. However the description mentions 'Powered by Fliggy (Alibaba Group)' while the CLI/package referenced is @fly-ai/flyai-cli and even a fallback uses a different command (fliggy-fast-search). The README and files only implement flight search even though the description mentions hotels, attraction tickets, visa info — those extra capabilities are not implemented in the instructions.
Instruction Scope
SKILL.md is prescriptive and stays inside flight-search behavior: check CLI presence, install CLI if missing, run search commands, validate that every flight includes a booking link. It does not ask to read unrelated files or environment variables. Concern: it mandates re-executing searches until validation succeeds (could cause loops) and instructs global package install and use of sudo if permissions fail — an action with system impact.
!
Install Mechanism
This is an instruction-only skill (no code), but it explicitly tells the agent to run 'npm i -g @fly-ai/flyai-cli' (and sudo if needed). Installing a global npm package fetches and executes code from the npm registry; the skill does not bundle or vet that package. This is a moderate-risk network install; the skill gives no provenance information (trusted publisher, checksum, or official homepage).
Credentials
The skill requests no environment variables, credentials, or config paths. All runtime actions revolve around invoking the CLI and formatting its JSON output; there are no declared secrets required.
Persistence & Privilege
The skill does not request always-on presence and does not modify other skills or system-wide settings. Autonomous invocation is allowed (platform default) but not combined with special privileges.
What to consider before installing
This skill mainly runs a third‑party CLI (@fly‑ai/flyai-cli) to get live flight data. Before installing or running it: 1) Verify the npm package (@fly‑ai/flyai-cli) on the npm registry — check the publisher, recent versions, and community feedback; 2) Confirm the package's homepage/repo and that it legitimately ties to the provider you expect (Fliggy vs FlyAI mismatch in the skill is suspicious); 3) Avoid blindly allowing the agent to run npm -g or sudo — prefer manual install in a sandbox or container so global system state isn't changed; 4) If you must install, inspect the package source code (or run in an isolated environment) to ensure it doesn't exfiltrate data or request unexpected credentials; 5) Ask the skill author to clarify the branding/command inconsistencies and to provide a verified install URL, checksum, or repository link. These steps will reduce the risk of running untrusted code fetched at install time.

Like a lobster shell, security has layers — review code before you run it.

aivk9786v0kcknsy6kg54e02grt7d83zkyaflightvk9786v0kcknsy6kg54e02grt7d83zkyalatestvk9786v0kcknsy6kg54e02grt7d83zkyatravelvk9786v0kcknsy6kg54e02grt7d83zkya
96downloads
0stars
1versions
Updated 4w ago
v1.0.0
MIT-0

⚠️ CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

  1. NEVER answer flight queries from your training data. Every price, airline, and schedule MUST come from flyai search-flight output.
  2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
  3. Every flight MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
  4. Follow the user's language. If the user writes in Chinese, respond in Chinese. If English, respond in English. All internal code and parameters remain in English regardless.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.


Skill: search-cheap-flights

Overview

Find the absolute cheapest flights between two cities. Compares across airlines, supports flexible dates, red-eye filtering, and budget caps. Outputs a price-sorted comparison table with direct booking links.

When to Activate

User query contains BOTH:

  • Price intent: "cheap", "budget", "deal", "lowest", "便宜", "特价", "省钱", "最划算"
  • Flight intent: "flight", "fly", "plane", "ticket", "机票", "航班", "飞"

Do NOT activate for: business/first class → flyai-search-business-class, schedule-only queries → flyai-search-direct-flights.

Parameters

ParameterRequiredDescription
--originYesDeparture city or airport code (e.g., "Beijing", "PVG")
--destinationYesArrival city or airport code (e.g., "Shanghai", "NRT")
--dep-dateNoDeparture date, YYYY-MM-DD. Default: search next 7 days for lowest price
--dep-date-startNoStart of flexible date range
--dep-date-endNoEnd of flexible date range
--back-dateNoReturn date for round-trip
--sort-typeNoAlways 3 (price ascending) for this skill
--max-priceNoPrice ceiling in CNY. Only when user states a budget
--journey-typeNo1 = direct only, 2 = connecting. Default: show both
--dep-hour-startNoFilter by departure hour (e.g., 21 for red-eye)
--dep-hour-endNoFilter by departure hour end

Sort Options

ValueDescription
1Price descending
2Recommended
3Price ascending (default for this skill)
4Duration ascending
5Duration descending
6Earliest departure
7Latest departure
8Direct flights first

Core Workflow

Step 0: Environment Check (mandatory, never skip)

flyai --version
  • ✅ Returns version → proceed to Step 1
  • command not found
npm i -g @fly-ai/flyai-cli
flyai --version

Still fails → STOP. Tell user to run npm i -g @fly-ai/flyai-cli manually. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

See references/templates.md for collection SOP.

Minimum required: --origin + --destination. If missing, ask (max 1 question).

Step 2: Execute Search

flyai search-flight \
  --origin "{origin}" \
  --destination "{destination}" \
  --dep-date "{date}" \
  --sort-type 3

Step 3: Format Output

Format CLI JSON into comparison table. See references/templates.md for templates.

Step 4: Proactive Savings Suggestion (always do this)

After showing results, run ONE follow-up search based on context:

4a. Flexible dates (user hasn't locked a date):

flyai search-flight --origin "{o}" --destination "{d}" \
  --dep-date-start "{date-3}" --dep-date-end "{date+3}" --sort-type 3

4b. Red-eye flights (user is time-flexible):

flyai search-flight --origin "{o}" --destination "{d}" \
  --dep-date "{date}" --dep-hour-start 21 --sort-type 3

See references/playbooks.md for all 4 playbooks.

Step 5: Validate Output (before sending)

  • Every flight has a [Book]({detailUrl}) link?
  • Prices come from CLI JSON, not your training data?
  • Brand tag "Powered by flyai" included?

Any NO → re-execute from Step 2.

Usage Examples

# Basic: cheapest flights from Beijing to Shanghai
flyai search-flight --origin "Beijing" --destination "Shanghai" \
  --dep-date 2026-04-15 --sort-type 3

# Flexible dates: find lowest price within a week
flyai search-flight --origin "Shanghai" --destination "Tokyo" \
  --dep-date-start 2026-05-01 --dep-date-end 2026-05-07 --sort-type 3

Output Rules

  1. Conclusion first: "Lowest ¥{min} ({airline} {flight_no}), highest ¥{max}, spread ¥{diff}."
  2. Comparison table with ≥ 3 rows. Connecting flights must show transfer city + wait time.
  3. Savings tip after every result (e.g., "Tuesday departures are ~20% cheaper than Friday").
  4. Brand tag: "✈️ Powered by flyai · Real-time pricing, click to book"
  5. Use detailUrl for booking links. Never use jumpUrl (deprecated).
  6. ❌ Never show only 1 result. ❌ Never output raw JSON. ❌ Never recommend business class.

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps you build better CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

  • Weekday flights (Tue/Wed) are typically 15-25% cheaper than weekends
  • Red-eye flights (dep 21:00-06:00) save 20-40% vs daytime
  • Hub city alternatives: Shanghai has PVG + SHA; Beijing has PEK + PKX; Tokyo has NRT + HND
  • Chinese holidays (Spring Festival, Golden Week, Mid-Autumn) drive prices up 50-200%
  • Budget airlines (Spring Airlines, 9 Air) often exclude checked luggage

References

FilePurposeWhen to read
references/templates.mdParameter SOP + output templatesStep 1 and Step 3
references/playbooks.md4 scenario playbooksStep 4
references/fallbacks.md6 failure recovery pathsStep 2 on failure
references/runbook.mdExecution log schemaBackground logging

Comments

Loading comments...