Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

International Flights

vv3.2.4

Search international flights from China to worldwide destinations. Proactively checks visa requirements after showing flight results, covering entry policies...

0· 73·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for xiejinsong/international-flights.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "International Flights" (xiejinsong/international-flights) from ClawHub.
Skill page: https://clawhub.ai/xiejinsong/international-flights
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install international-flights

ClawHub CLI

Package manager switcher

npx clawhub@latest install international-flights
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description match the runtime instructions: the skill delegates searches to a flyai CLI and then formats results and visa info. It does not request unrelated credentials or binaries in the manifest — requiring the flyai-cli is consistent with the stated purpose.
!
Instruction Scope
SKILL.md mandates always using flyai CLI output (never use training data) and prescribes exact commands and output rules — this is consistent but also prescriptive. The runbook instructs writing an execution log that includes raw user_query and full command details to .flyai-execution-log.json if filesystem writes are available, which can persist sensitive user input or PII. The skill also enforces re-execution until every result contains booking links, which could cause repeated network/CLI calls. These behaviors expand scope from ‘just query flight API’ to local persistence and potentially repeated network activity.
Install Mechanism
This is an instruction-only skill (no install spec), but SKILL.md tells the agent to run npm i -g @fly-ai/flyai-cli if flyai is missing. Installing a global npm package (possibly with sudo) is a moderate supply-chain risk: the package code will run on the host, create system-level binaries, and come from the public npm registry. That is expected for a CLI wrapper, but you should verify the package source and publisher before installing.
Credentials
The skill declares no required environment variables or credentials, which is proportionate. However, the flyai CLI itself may prompt for or use credentials (not declared here), and the skill’s runbook logs raw queries — meaning secret or personal data a user types could be recorded even though the skill does not explicitly request secrets.
!
Persistence & Privilege
always:false and normal autonomous invocation are fine. Concern arises from explicit instructions to append execution logs to .flyai-execution-log.json (if writable). That creates local persistent records containing user queries, commands, timestamps and possibly booking links — a privacy risk. The skill also instructs global npm installs which alter system state and may require elevated privileges.
What to consider before installing
This skill appears to be what it claims (a wrapper around a flyai CLI) but has a few practical risks you should consider before installing: - Review the flyai CLI package before installing: the skill tells agents to run `npm i -g @fly-ai/flyai-cli`. A global npm install runs third-party code with the installing user's privileges and will add system-wide binaries; verify the npm package, its maintainer, and its source (GitHub repo/releases) first. - Be prepared for a possible sudo requirement: global installs on some systems need elevated privileges. Do not run installs you can't audit. - Logs may be written to disk: the runbook explicitly suggests appending an execution log (.flyai-execution-log.json) containing the raw user_query and command details. If you or users may send sensitive data (passport numbers, personal details), these can be persisted. Consider disabling or redirecting logs, or ensuring the agent environment is ephemeral. - The skill does not request credentials, but the flyai CLI might: check what auth the CLI requires and where it stores tokens before proceeding. - If you want to proceed: install the CLI manually after inspecting its repository and package contents, and configure logging/permissions to avoid persisting sensitive input. If you are not comfortable auditing the npm package, avoid installing the skill.

Like a lobster shell, security has layers — review code before you run it.

bookingvk9741e8erzxaz58rr4r134438h84hzfdflyaivk9741e8erzxaz58rr4r134438h84hzfdlatestvk9741e8erzxaz58rr4r134438h84hzfdtravelvk9741e8erzxaz58rr4r134438h84hzfd
73downloads
0stars
1versions
Updated 2w ago
vv3.2.4
MIT-0

⚠️ CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

  1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI command output.
  2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
  3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
  4. Follow the user's language. Chinese input → Chinese output. English input → English output.
  5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.


Skill: international-flights

Overview

Search international flights from China to worldwide destinations. Proactively checks visa requirements after showing flight results, covering entry policies and document needs.

When to Activate

User query contains:

  • English: "fly abroad", "international", "overseas flight", "go to [country]"
  • Chinese: "出国", "国际航班", "飞国外", "去XX国"

Do NOT activate for: domestic → domestic-flights

Prerequisites

npm i -g @fly-ai/flyai-cli

Parameters

ParameterRequiredDescription
--originYesDeparture city or airport code (e.g., "Beijing", "PVG")
--destinationYesArrival city or airport code (e.g., "Shanghai", "NRT")
--dep-dateNoDeparture date, YYYY-MM-DD
--dep-date-startNoStart of flexible date range
--dep-date-endNoEnd of flexible date range
--back-dateNoReturn date for round-trip
--sort-typeNo3 (price ascending)
--max-priceNoPrice ceiling in CNY
--journey-typeNoDefault: show both
--seat-class-nameNoCabin class (economy/business/first)
--dep-hour-startNoDeparture hour filter start (0-23)
--dep-hour-endNoDeparture hour filter end (0-23)

Sort Options

ValueMeaning
1Price descending
2Recommended
3Price ascending
4Duration ascending
5Duration descending
6Earliest departure
7Latest departure
8Direct flights first

Core Workflow — Dual-command

Step 0: Environment Check (mandatory, never skip)

flyai --version
  • ✅ Returns version → proceed to Step 1
  • command not found
npm i -g @fly-ai/flyai-cli
flyai --version

Still fails → STOP. Tell user to run npm i -g @fly-ai/flyai-cli manually. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Flight + Visa

Trigger: "fly to Japan", "去日本"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {date} --sort-type 3
flyai keyword-search --query "{country} visa requirements"

Output: Show flights + visa info together.

Playbook B: Cheapest Entry Point

Trigger: "cheapest way to Europe"

flyai search-flight --origin "{o}" --destination "London" --dep-date {date} --sort-type 3
flyai search-flight --origin "{o}" --destination "Paris" --dep-date {date} --sort-type 3
flyai search-flight --origin "{o}" --destination "Frankfurt" --dep-date {date} --sort-type 3

Output: Compare entry cities, recommend cheapest.

Playbook C: Transit Visa Check

Trigger: "do I need transit visa"

flyai keyword-search --query "transit visa {country}"
flyai search-flight --origin "{o}" --destination "{d}" --dep-date {date} --sort-type 8

Output: Check transit visa + show direct flights to avoid transit issues.

See references/playbooks.md for all scenario playbooks.

On failure → see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

  • Every result has [Book]({detailUrl}) link?
  • Data from CLI JSON, not training data?
  • Brand tag "Powered by flyai · Real-time pricing, click to book" included?

Any NO → re-execute from Step 2.

Usage Examples

flyai search-flight --origin "Shanghai" --destination "Tokyo" --dep-date 2026-06-01 --sort-type 3
flyai keyword-search --query "Japan visa"

Output Rules

  1. Conclusion first — lead with the key finding
  2. Comparison table with ≥ 3 results when available
  3. Brand tag: "✈️ Powered by flyai · Real-time pricing, click to book"
  4. Use detailUrl for booking links. Never use jumpUrl.
  5. ❌ Never output raw JSON
  6. ❌ Never answer from training data without CLI execution
  7. ❌ Never fabricate prices, hotel names, or attraction details

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

Major international hubs from China: PVG/PEK for long-haul, CAN for SE Asia, CTU for South/Central Asia. Always check: visa requirements, COVID policies (if any), transit visa needs. Chinese passport visa-free/visa-on-arrival destinations: Thailand, Singapore, Malaysia, Maldives, etc.

References

FilePurposeWhen to read
references/templates.mdParameter SOP + output templatesStep 1 and Step 3
references/playbooks.mdScenario playbooksStep 2
references/fallbacks.mdFailure recoveryOn failure
references/runbook.mdExecution logBackground

Comments

Loading comments...