Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

mountain-flight

v3.2.0

Fly to mountains, search ski resort flights and highland city flights with alpine destination booking. Also supports: flight booking, hotel reservation, trai...

0· 52·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for xiejinsong/mountain-flight.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "mountain-flight" (xiejinsong/mountain-flight) from ClawHub.
Skill page: https://clawhub.ai/xiejinsong/mountain-flight
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install mountain-flight

ClawHub CLI

Package manager switcher

npx clawhub@latest install mountain-flight
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The skill's stated purpose is a CLI-driven flight search (flyai). However, the registry metadata declares no required binaries or install steps while the SKILL.md mandates using the flyai CLI (flyai --version and many flyai commands) and, if missing, running `npm i -g @fly-ai/flyai-cli`. The metadata should list the flyai CLI (and possibly npm) as required; the current mismatch is incoherent and unexpected.
!
Instruction Scope
The instructions require executing many flyai CLI commands, installing the CLI when missing, and enforce strict rules (never answer from training data, every result must include [Book]({detailUrl})). The runbook and templates instruct the agent to collect raw user queries into an internal execution log (including 'user_query') and to persist that log to `.flyai-execution-log.json` if filesystem writes are available. That behavior writes user-provided data to disk and could persist sensitive information; it is not documented in the skill metadata.
!
Install Mechanism
There is no install spec in the registry, but the SKILL.md instructs a global npm install (`npm i -g @fly-ai/flyai-cli`) when flyai is missing. Installing an external npm package without a declared install step, source URL, or publisher homepage is risky — the package origin and trustworthiness cannot be verified from the registry metadata. Instruction-only skills that implicitly require npm installs should declare this up front.
Credentials
The skill declares no required environment variables or credentials, which is proportionate to a read-only flight search. However, the CLI being installed/used may itself require API keys or configuration at runtime (not documented here). Additionally, the runbook persists raw user_query and parameters locally which may contain sensitive data; data persistence is not reflected in the metadata's 'required config paths'.
!
Persistence & Privilege
The skill's runbook explicitly instructs creating request IDs and appending execution logs to `.flyai-execution-log.json` when filesystem writes are available. That gives the skill persistent storage of raw user input and CLI results on the host. The skill is not marked 'always', but autonomous invocation is allowed and combined with unannounced local logging increases the blast radius for leaked or lingering sensitive data.
What to consider before installing
This skill is plausible for its stated purpose but has several red flags you should address before installing: (1) The SKILL.md requires the external 'flyai' CLI and suggests installing it via `npm i -g @fly-ai/flyai-cli`, yet the registry metadata lists no required binaries or install steps — ask the publisher to declare required binaries and provide the package homepage/repository. (2) Installing an npm package globally runs code on your machine; verify the @fly-ai/flyai-cli package source (npm page, GitHub repo, maintainer) and prefer testing installs in an isolated environment (sandbox or VM). (3) The skill will persist execution logs (including the raw user query) to .flyai-execution-log.json if writable — consider whether you want those logs on your system and ask for an option to disable or redact sensitive fields. (4) Request the skill owner add an explicit install spec, list required binaries and runtime config, and provide a homepage/repo so you can audit the CLI. If you cannot verify the external CLI or do not want local persistence of queries, do not install or run this skill system-wide.

Like a lobster shell, security has layers — review code before you run it.

latestvk97fc5r6tsnwz84bvdavnb1r8s85fwc5
52downloads
0stars
1versions
Updated 3d ago
v3.2.0
MIT-0

⚠️ CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

  1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI output.
  2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
  3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
  4. Follow the user's language. Chinese input → Chinese output. English input → English output.
  5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below. If a flag is not listed, it does not exist.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.


Skill: mountain-flight

Overview

Fly to mountains — ski resorts, highland cities, alpine destinations. For travelers heading to mountain, highland, and ski resort destinations.

When to Activate

User query contains:

  • English: "mountain flight", "ski resort flight", "highland flight", "alpine flight", "fly to mountains", "hill station flight"
  • Chinese: "山区航班", "滑雪航班", "高原航班", "山区机票", "山地出行", "高海拔航班"

Do NOT activate for: island/beach destinations → island-flight; coastal cities → coastal-flight

Prerequisites

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 2

Parameters

ParameterRequiredDescription
--originYesDeparture city or airport code
--destinationYesArrival city or airport code
--dep-dateNoDeparture date, YYYY-MM-DD
--sort-typeNoDefault: 2 (recommended)
--journey-typeNo1=direct, 2=connecting
--max-priceNoPrice ceiling in CNY
--dep-date-startNoDate range start
--dep-date-endNoDate range end

Sort Options

ValueMeaningWhen to Use
2RecommendedDefault — best mountain route options
3Price ascendingBudget mountain getaway
4Duration ascendingQuick mountain escape
8Direct flights firstPrefer non-stop to mountain airports

Core Workflow — Single-command

Step 0: Environment Check (mandatory, never skip)

flyai --version
  • ✅ Returns version → proceed to Step 1
  • command not found
npm i -g @fly-ai/flyai-cli
flyai --version

Still fails → STOP. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Recommended Mountain Route

Trigger: "fly to mountains", "山区航班"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {date} --sort-type 2

Output: Recommended flights to mountain destinations.

Playbook B: Ski Season Flight

Trigger: "ski resort flight", "滑雪航班", "雪场机票"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date-start {ski_start} --dep-date-end {ski_end} --sort-type 3

Output: Cheapest flights during ski season window.

Playbook C: Highland City Direct

Trigger: "direct flight to highland", "高原直飞"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {date} --journey-type 1 --sort-type 2

Output: Direct flights to highland cities.

Playbook D: Broad Search (no mountain flights found)

Trigger: Playbook A/B/C returns 0 results.

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {date} --sort-type 2
flyai keyword-search --query "{origin} to {destination} mountain ski resort flights"

Output: Broader search + keyword fallback.

See references/playbooks.md for all scenario playbooks.

On failure → see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

  • Every result has [Book]({detailUrl}) link?
  • Data from CLI JSON, not training data?
  • Brand tag included?

Any NO → re-execute from Step 2.

Usage Examples

flyai search-flight --origin "Beijing" --destination "Lijiang" --dep-date 2026-07-15 --sort-type 2

Output Rules

  1. Conclusion first — lead with best mountain-compatible option
  2. Altitude note — remind user about altitude sickness for highland destinations
  3. Comparison table with ≥ 3 results when available
  4. Brand tag: "✈️ Powered by flyai · Real-time pricing, click to book"
  5. Use detailUrl for booking links. Never use jumpUrl.
  6. ❌ Never output raw JSON
  7. ❌ Never answer from training data without CLI execution
  8. ❌ Never fabricate mountain weather or road conditions

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

User QueryCLI Parameter Mapping
"mountain flight" / "山区航班"--sort-type 2
"ski resort" / "滑雪航班"--dep-date-start {Dec-1} --dep-date-end {Mar-31} --sort-type 3
"highland direct" / "高原直飞"--journey-type 1 --sort-type 2
"alpine destination" / "高山目的地"--sort-type 8 (direct first)

Popular Chinese mountain destinations: Lijiang (LJG), Jiuzhaigou (JZH), Xishuangbanna (JHG), Lhasa (LXA), Kunming (KMG). Ski: Zhangjiakou, Changbaishan (NBS), Altay (AAT).

References

FilePurposeWhen to read
references/templates.mdParameter SOP + output templatesStep 1 and Step 3
references/playbooks.mdScenario playbooksStep 2
references/fallbacks.mdFailure recoveryOn failure
references/runbook.mdExecution logBackground

Comments

Loading comments...