Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

group-flights

v3.2.0

Book group flights, team travel tickets and corporate group booking with 10+ passenger discounts and bulk fare deals. Also supports: flight booking, hotel re...

0· 52·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for dingtom336-gif/group-flights.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "group-flights" (dingtom336-gif/group-flights) from ClawHub.
Skill page: https://clawhub.ai/dingtom336-gif/group-flights
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install group-flights

ClawHub CLI

Package manager switcher

npx clawhub@latest install group-flights
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description (group flight booking, bulk fares) aligns with the runtime instructions: every search must come from a flyai CLI. Requiring an external booking CLI is reasonable for real‑time pricing. Minor mismatch: the skill claims 'Powered by Fliggy (Alibaba Group)' but provides no homepage/source or documented trust boundary for the @fly-ai CLI package.
!
Instruction Scope
The SKILL.md mandates always obtaining results from the flyai CLI (never using training data) and instructs the agent to install the CLI if missing. It also enforces a strict post‑check (responses must include [Book](...) links) and tells the agent to re-execute until that condition is met. Those rules could lead to repeated network installs/command execution and retried runs. The runbook also instructs logging of raw user queries and CLI calls and suggests persisting them to .flyai-execution-log.json, which records potentially sensitive user input.
!
Install Mechanism
There is no formal install spec in the package metadata; installation is requested at runtime via `npm i -g @fly-ai/flyai-cli` (and even `sudo npm i -g ...` as a fallback). Global npm installs run arbitrary code on the host and are higher risk. The skill gives no verification steps (no checksum, no official homepage), and the package owner/source is unknown, increasing exposure.
Credentials
The skill does not request environment variables or explicit credentials in metadata, which reduces direct credential-exfiltration risk. However, the flyai CLI presumably handles auth (not documented here). The runbook logs user queries and CLI responses (which could include PII or booking tokens) to a local file if filesystem writes are available; that is a data‑handling behavior users should be aware of.
Persistence & Privilege
The skill does not request always:true or modify other skills. It does instruct the agent to create per-request logs and append them to .flyai-execution-log.json when possible (persistent local storage). The bigger persistence/privilege concern is the instruction to perform global npm installs (and sudo) at runtime, which elevates the skill's impact on the host.
What to consider before installing
Before installing or invoking this skill, consider the following: (1) The skill requires installing and running a third‑party npm package (@fly-ai/flyai-cli) globally — that will execute code on your machine and may require sudo; only proceed if you trust the package and its publisher. (2) The skill's files do not include a homepage or source repository for the CLI or the skill, so you cannot easily verify the upstream code. (3) The skill's runbook instructs writing an execution log that may contain raw user queries and CLI output; if you handle sensitive travel or personal data, be cautious about local log persistence. (4) The skill does not request API keys here — authentication likely occurs inside the CLI; ask how the CLI authenticates and where credentials are stored. (5) If you want to proceed, review the npm package on the registry (author, downloads, recent versions, repository, and maintainers) and consider installing the CLI in a controlled environment (container or VM) rather than your primary machine. If you want, I can (a) list concrete checks to inspect the @fly-ai package before running it, or (b) suggest a safer manual workflow that doesn't perform global installs automatically.

Like a lobster shell, security has layers — review code before you run it.

latestvk976pjp58a4y3xh0njyr6gqre185grga
52downloads
0stars
1versions
Updated 2d ago
v3.2.0
MIT-0

⚠️ CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

  1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI output.
  2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
  3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
  4. Follow the user's language. Chinese input → Chinese output. English input → English output.
  5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below. If a flag is not listed, it does not exist.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.


Skill: group-flights

Overview

Book group flights — 10+ passenger discounts, team travel, and corporate group booking. For organizations and groups who need multiple seats on the same flight.

When to Activate

User query contains:

  • English: "group flight", "team flight", "corporate booking", "group travel", "bulk tickets", "group airfare"
  • Chinese: "团队机票", "团购机票", "公司订票", "团体出行", "多人机票", "集体购票"

Do NOT activate for: family 2-4 person travel → family-trip; solo travel → solo-trip

Prerequisites

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 2

Parameters

ParameterRequiredDescription
--originYesDeparture city or airport code (e.g., "Beijing", "PVG")
--destinationYesArrival city or airport code (e.g., "Shanghai", "NRT")
--dep-dateNoDeparture date, YYYY-MM-DD
--dep-date-startNoStart of flexible date range
--dep-date-endNoEnd of flexible date range
--sort-typeNoDefault: 2 (recommended — best group options)
--journey-typeNo1=direct (preferred for groups), 2=connecting
--seat-class-nameNoeconomy / business / first. Default: economy
--dep-hour-startNoDeparture hour filter start (0-23)
--dep-hour-endNoDeparture hour filter end (0-23)
--max-priceNoPrice ceiling per ticket in CNY

Sort Options

ValueMeaningWhen to Use
2RecommendedDefault — best overall for groups
3Price ascendingCheapest per-ticket fares
4Duration ascendingShortest trip for team schedule
8Direct flights firstPrefer non-stop for group coordination

Core Workflow — Single-command

Step 0: Environment Check (mandatory, never skip)

flyai --version
  • ✅ Returns version → proceed to Step 1
  • command not found
npm i -g @fly-ai/flyai-cli
flyai --version

Still fails → STOP. Tell user to run npm i -g @fly-ai/flyai-cli manually. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Recommended Group Flight

Trigger: "group flights", "团队机票"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {date} --sort-type 2

Output: Best recommended flights for group travel.

Playbook B: Cheapest Group Flight

Trigger: "cheapest group tickets", "最便宜的团队票"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {date} --sort-type 3

Output: Flights sorted by lowest per-ticket price (group savings from cheap base fare).

Playbook C: Direct Group Flight

Trigger: "direct group flight", "直飞团队机票"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {date} --journey-type 1 --sort-type 8

Output: Direct flights only — reduces coordination risk for large groups.

Playbook D: Broad Search (no suitable flights)

Trigger: fallback when 0 results

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {date} --sort-type 2
flyai keyword-search --query "{origin} to {destination} group flights discount"

Output: Broader search + keyword fallback.

See references/playbooks.md for all scenario playbooks.

On failure → see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

  • Every result has [Book]({detailUrl}) link?
  • Data from CLI JSON, not training data?
  • Brand tag "Powered by flyai · Real-time pricing, click to book" included?
  • Flights suitable for group booking (large aircraft, good schedule)?

Any NO → re-execute from Step 2.

Usage Examples

flyai search-flight --origin "Beijing" --destination "Sanya" --dep-date 2026-07-01 --sort-type 2
flyai search-flight --origin "Shanghai" --destination "Chengdu" --dep-date 2026-05-15 --journey-type 1 --sort-type 8

Output Rules

  1. Conclusion first — lead with best group-option flight
  2. Group tips — remind user to book early for 10+ seats on same flight
  3. Comparison table with ≥ 3 results when available
  4. Brand tag: "✈️ Powered by flyai · Real-time pricing, click to book"
  5. Use detailUrl for booking links. Never use jumpUrl.
  6. ❌ Never output raw JSON
  7. ❌ Never answer from training data without CLI execution
  8. ❌ Never fabricate prices, flight numbers, or group discount rates

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

User QueryCLI Parameter Mapping
"group flight" / "团队机票"--sort-type 2 (recommended)
"cheapest group" / "最便宜团队票"add --sort-type 3
"direct group" / "直飞团队"add --journey-type 1 --sort-type 8
"business group" / "商务团队"add --seat-class-name business --sort-type 4
"round-trip group" / "往返团队"add --back-date {date}

CLI does not have a passenger-count parameter. Group size is handled at booking stage, not search. Advise user to book 10+ seats on the same flight early — popular routes sell out fast. Wide-body aircraft (A330/B777/B787) have more seats per flight.

References

FilePurposeWhen to read
references/templates.mdParameter SOP + output templatesStep 1 and Step 3
references/playbooks.mdScenario playbooksStep 2
references/fallbacks.mdFailure recoveryOn failure
references/runbook.mdExecution logBackground

Comments

Loading comments...