Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill description claims active, transactional capabilities (flight search, booking, check-in, mileage management, upgrades, lounge services) which normally require API access, user credentials, or external integrations. The skill requests no credentials, no config, and includes only an informational SKILL.md — this mismatch suggests the description overstates capabilities or is misleading.
Instruction Scope
SKILL.md contains only an informational 'JAL information station' (history, business scope, global layout, latest news) and guidance to visit the official website. It does not contain any runtime instructions to perform bookings, check-ins, or manage miles. The instructions therefore do not implement the transactional features claimed in the description.
Install Mechanism
There is no install specification and no code files. As an instruction-only skill, it does not write to disk or pull code at install time, which is low-risk from an installation perspective.
Credentials
The skill declares no required environment variables or credentials. Given the description's transactional features (which would normally require airline accounts, OAuth tokens, or API keys), the absence of any credential requests is disproportionate and indicates the skill either cannot perform those actions or is omitting required details.
Persistence & Privilege
The skill does not request persistent presence (always: false) and does not declare any system-wide modifications or elevated privileges. Autonomous invocation is allowed by default but is not combined with other concerning privileges here.
What to consider before installing
This skill's description promises transactional JAL services (searching and booking flights, checking in, managing miles), but its runtime instructions only provide static informational content. Before installing: (1) Treat the skill as an informational FAQ only — it currently cannot perform bookings or check-ins. (2) Do not provide airline credentials, payment details, or personal PII to this skill unless the publisher documents secure, official integrations. (3) Prefer official airline integrations or well-documented third-party services for bookings and account management. (4) If you need transactional features, ask the publisher for details about API endpoints, required credentials, and why none are declared; lack of such details is a red flag.Like a lobster shell, security has layers — review code before you run it.
latestvk972ax3dtedsz3kpbw668t1tnn84xerz
License
MIT-0
Free to use, modify, and redistribute. No attribution required.