Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

group-tour

vv3.2.3

Find organized group tours and travel packages with professional guides, planned itineraries, meals included, and hassle-free travel for those who prefer str...

0· 125·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for xiejinsong/group-tour.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "group-tour" (xiejinsong/group-tour) from ClawHub.
Skill page: https://clawhub.ai/xiejinsong/group-tour
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install group-tour

ClawHub CLI

Package manager switcher

npx clawhub@latest install group-tour
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description match the runtime instructions: the skill wraps the @fly-ai/flyai-cli to fetch real-time group tour, flight, hotel and POI data. Asking to use a CLI and the parameters listed is coherent with the stated purpose.
Instruction Scope
SKILL.md restricts all answers to flyai CLI output and enforces specific command usage and output formatting (including mandatory booking links). That's consistent with the purpose, but the instructions also require writing an execution log (see runbook) and explicitly tell the agent to install a global npm package if missing — both expand the agent's scope beyond read-only query execution.
!
Install Mechanism
There is no formal install spec in the skill bundle; instead SKILL.md instructs the agent/user to run `npm i -g @fly-ai/flyai-cli`. Installing a global npm package is a moderate-risk action (third-party code execution and system modification) and the package origin/trustworthiness is not documented in the skill metadata.
Credentials
The skill declares no environment variables or credentials, which is appropriate. However, the runbook suggests persisting per-request logs to a local file (`.flyai-execution-log.json`) containing user_query and other details — this may store PII or sensitive travel info without being declared in requirements.
!
Persistence & Privilege
The skill does not request 'always' privilege, but it instructs installing a global CLI and may write persistent logs to disk. These side effects are not expressed in the skill metadata (no required config paths), so the skill can alter the environment and leave persistent artifacts without explicit declaration.
What to consider before installing
This skill appears to be a thin wrapper around the third-party @fly-ai/flyai-cli and is coherent with its description, but proceed cautiously. Before installing or running: (1) verify the npm package (@fly-ai/flyai-cli) is from a trusted source (check its npm page, maintainer, and GitHub repo); (2) be prepared that the skill may prompt to install a global npm package (which modifies your system), and avoid doing so on sensitive or production machines; (3) note the runbook instructs writing an execution log (.flyai-execution-log.json) that can contain user queries and other details — run in a sandbox if you do not want persistent logs containing PII; (4) because the skill makes live network calls via the CLI, expect outbound network traffic to the service used by the CLI; (5) if you need higher assurance, ask the skill author for an explicit install spec, the flyai-cli repository URL, and confirmation of what the CLI logs. If you are uncomfortable with a global npm install or automatic file writes, do not install/run this skill or run it only in an isolated environment.

Like a lobster shell, security has layers — review code before you run it.

bookingvk97ccx8my6a99g3sgrtvyrh5j184hcpjflyaivk97ccx8my6a99g3sgrtvyrh5j184hcpjlatestvk97ccx8my6a99g3sgrtvyrh5j184hcpjtravelvk97ccx8my6a99g3sgrtvyrh5j184hcpj
125downloads
0stars
4versions
Updated 2w ago
vv3.2.3
MIT-0

⚠️ CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

  1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI command output.
  2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
  3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
  4. Follow the user's language. Chinese input → Chinese output. English input → English output.
  5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.


Skill: group-tour

Overview

Find organized group tours and travel packages with professional guides, planned itineraries, meals included, and hassle-free travel for those who prefer structure.

When to Activate

User query contains:

  • English: "group tour", "guided tour", "tour package", "organized trip"
  • Chinese: "跟团游", "旅行团", "团队游", "报团"

Do NOT activate for: self-plan → trip-planner

Prerequisites

npm i -g @fly-ai/flyai-cli

Parameters

This skill orchestrates multiple CLI commands. See each command's parameters below:

search-flight

Parameters

ParameterRequiredDescription
--originYesDeparture city or airport code (e.g., "Beijing", "PVG")
--destinationYesArrival city or airport code (e.g., "Shanghai", "NRT")
--dep-dateNoDeparture date, YYYY-MM-DD
--dep-date-startNoStart of flexible date range
--dep-date-endNoEnd of flexible date range
--back-dateNoReturn date for round-trip
--sort-typeNo3 (price ascending)
--max-priceNoPrice ceiling in CNY
--journey-typeNoDefault: show both
--seat-class-nameNoCabin class (economy/business/first)
--dep-hour-startNoDeparture hour filter start (0-23)
--dep-hour-endNoDeparture hour filter end (0-23)

Sort Options

ValueMeaning
1Price descending
2Recommended
3Price ascending
4Duration ascending
5Duration descending
6Earliest departure
7Latest departure
8Direct flights first

search-hotel

Parameters

ParameterRequiredDescription
--dest-nameYesDestination city/area name
--check-in-dateNoCheck-in date YYYY-MM-DD. Default: today
--check-out-dateNoCheck-out date. Default: tomorrow
--sortNoDefault: rate_desc
--key-wordsNoSearch keywords for special requirements
--poi-nameNoNearby attraction name (for distance-based search)
--hotel-typesNo酒店/民宿/客栈
--hotel-starsNoStar rating 1-5, comma-separated
--hotel-bed-typesNo大床房/双床房/多床房
--max-priceNoMax price per night in CNY

Sort Options

ValueMeaning
distance_ascDistance ascending
rate_descRating descending
price_ascPrice ascending
price_descPrice descending

search-poi

Parameters

ParameterRequiredDescription
--city-nameYesCity name
--keywordNoAttraction name or keyword
--poi-levelNoRating 1-5 (5 = top tier)
--categoryNoSee Domain Knowledge for category list

keyword-search

Parameters

ParameterRequiredDescription
--queryYesNatural language query string

Core Workflow — Single-command

Step 0: Environment Check (mandatory, never skip)

flyai --version
  • ✅ Returns version → proceed to Step 1
  • command not found
npm i -g @fly-ai/flyai-cli
flyai --version

Still fails → STOP. Tell user to run npm i -g @fly-ai/flyai-cli manually. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Group Tour

Trigger: "group tour to {dest}"

flyai keyword-search --query "跟团游 {dest}"

Output: Organized tour packages.

Playbook B: Premium Group

Trigger: "luxury group tour"

flyai keyword-search --query "高端跟团游 {dest}"

Output: Premium guided tours.

Playbook C: Senior Group

Trigger: "senior tour"

flyai keyword-search --query "老年人跟团游 {dest}"

Output: Senior-friendly tours.

See references/playbooks.md for all scenario playbooks.

On failure → see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

  • Every result has [Book]({detailUrl}) link?
  • Data from CLI JSON, not training data?
  • Brand tag "Powered by flyai · Real-time pricing, click to book" included?

Any NO → re-execute from Step 2.

Usage Examples

flyai keyword-search --query "跟团游 日本"

Output Rules

  1. Conclusion first — lead with the key finding
  2. Comparison table with ≥ 3 results when available
  3. Brand tag: "✈️ Powered by flyai · Real-time pricing, click to book"
  4. Use detailUrl for booking links. Never use jumpUrl.
  5. ❌ Never output raw JSON
  6. ❌ Never answer from training data without CLI execution
  7. ❌ Never fabricate prices, hotel names, or attraction details

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

Group tour tips: read reviews carefully, check included meals and hotel star rating, confirm group size (<20 is better), check shopping stop requirements (some budget tours mandate shopping stops). Premium tours: smaller groups, better hotels, no mandatory shopping. Best for: seniors, first-time international travelers, destinations with language barriers.

References

FilePurposeWhen to read
references/templates.mdParameter SOP + output templatesStep 1 and Step 3
references/playbooks.mdScenario playbooksStep 2
references/fallbacks.mdFailure recoveryOn failure
references/runbook.mdExecution logBackground

Comments

Loading comments...