Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

multi-city

v3.2.0

Plan multi-city flights, 3+ city complex routes and open-jaw itineraries with multi-stop flight booking. Also supports: flight booking, hotel reservation, tr...

0· 65·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for xiejinsong/multi-city.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "multi-city" (xiejinsong/multi-city) from ClawHub.
Skill page: https://clawhub.ai/xiejinsong/multi-city
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install multi-city

ClawHub CLI

Package manager switcher

npx clawhub@latest install multi-city
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill claims to plan and book multi-city travel and instructs use of a CLI (flyai). Requiring a vendor CLI is coherent for this purpose. However the SKILL.md also claims “powered by Fliggy (Alibaba Group)” while the CLI package referenced is @fly-ai/flyai-cli — that branding mismatch and the lack of a source/homepage reduce confidence in provenance.
!
Instruction Scope
Runtime instructions mandate installing and invoking a third-party CLI and strictly require retrieving all data from flyai CLI output. The runbook includes persisting an execution log (echo '... >> .flyai-execution-log.json') containing raw user_query and step details — writing internal logs to the user's filesystem is not declared elsewhere and may capture sensitive input. The skill also enforces every result must contain a booking link and forbids using training data, which is operationally strict but not inherently malicious.
Install Mechanism
No install spec in the registry, but the SKILL.md tells the agent to run 'npm i -g @fly-ai/flyai-cli' if flyai is missing. Installing a global npm package is a moderate-risk action (arbitrary code from a public registry). The package name appears plausible for the claimed CLI, but there is no homepage/source URL in the registry metadata to verify the package or its maintainers.
Credentials
The skill does not request environment variables, credentials, or config paths, which is reasonable for a CLI-driven search tool. However, the runbook’s logging of raw user_query in a local file may store sensitive user data without declaring any config path or asking for user consent.
!
Persistence & Privilege
The skill is not always-enabled and does not request elevated privileges, which is good. Still, it instructs persisting execution logs to a hidden file (.flyai-execution-log.json) in the working directory if filesystem writes are available — that is persistent state created on the host without being declared in the skill manifest and could retain sensitive inputs.
What to consider before installing
Before installing or running this skill: 1) Verify the provenance of the flyai CLI package (@fly-ai/flyai-cli) on the npm registry — check its homepage, source repository, and maintainer reputation; 2) Be aware the skill asks to run a global 'npm i -g' which installs code globally — prefer running in an isolated environment or container if you test it; 3) The runbook will append execution logs (including your raw query) to .flyai-execution-log.json in the working directory if writes are available — decide if you’re comfortable with local logging or modify/remove that behavior; 4) The SKILL.md mentions Fliggy but uses 'flyai' CLI — ask the publisher to clarify which backend is used and for a homepage/source repo to audit; 5) Do not provide credentials to this skill; if you need to proceed, test it in a sandboxed environment and inspect the installed npm package code before production use.

Like a lobster shell, security has layers — review code before you run it.

latestvk976fg2bj8bbfc18veqyfbvt1s85fr72
65downloads
0stars
1versions
Updated 3d ago
v3.2.0
MIT-0

⚠️ CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

  1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI output.
  2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
  3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
  4. Follow the user's language. Chinese input → Chinese output. English input → English output.
  5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below. If a flag is not listed, it does not exist.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.


Skill: multi-city

Overview

Plan multi-city flights — 3+ cities, complex routes, open-jaw itineraries. For travelers visiting multiple destinations in one trip.

When to Activate

User query contains:

  • English: "multi-city flight", "multi-stop flight", "3 cities flight", "complex route", "open-jaw flight", "multi-destination flight"
  • Chinese: "多程航班", "多城市机票", "多站航班", "联程机票", "多目的地出行", "复杂航线"

Do NOT activate for: simple round-trip → round-trip; one-way → one-way

Prerequisites

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 2

Parameters

ParameterRequiredDescription
--originYesFirst departure city or airport code
--destinationYesFinal destination city or airport code
--dep-dateNoFirst leg departure date, YYYY-MM-DD
--dep-date-startNoStart of flexible date range
--dep-date-endNoEnd of flexible date range
--sort-typeNoDefault: 2 (recommended — best multi-city combos)
--journey-typeNo1=direct, 2=connecting
--seat-class-nameNoeconomy / business / first
--max-priceNoPrice ceiling per ticket in CNY

Sort Options

ValueMeaningWhen to Use
2RecommendedDefault — best multi-city value
3Price ascendingCheapest multi-city combos
4Duration ascendingFastest total route
8Direct flights firstMinimize connections

Core Workflow — Multi-command orchestration

Step 0: Environment Check (mandatory, never skip)

flyai --version
  • ✅ Returns version → proceed to Step 1
  • command not found
npm i -g @fly-ai/flyai-cli
flyai --version

Still fails → STOP. Tell user to run npm i -g @fly-ai/flyai-cli manually. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect route segments from user. Multi-city requires ≥2 flight legs. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands (leg by leg)

Playbook A: Standard Multi-City (3 cities)

Trigger: "multi-city flights", "多程航班" with 3 cities specified

# Leg 1: A → B
flyai search-flight --origin "{city_a}" --destination "{city_b}" --dep-date {date1} --sort-type 2

# Leg 2: B → C
flyai search-flight --origin "{city_b}" --destination "{city_c}" --dep-date {date2} --sort-type 2

# Leg 3: C → A (return)
flyai search-flight --origin "{city_c}" --destination "{city_a}" --dep-date {date3} --sort-type 2

Output: Flight options for each leg, presented as a complete itinerary.

Playbook B: Open-Jaw (fly A→B, return C→A)

Trigger: "open-jaw flight", "开口航班" with different return city

# Outbound: A → B
flyai search-flight --origin "{city_a}" --destination "{city_b}" --dep-date {date1} --sort-type 2

# Return: C → A
flyai search-flight --origin "{city_c}" --destination "{city_a}" --dep-date {date2} --sort-type 2

Output: Outbound + return flights with ground travel note for B→C segment.

Playbook C: Stopover City (A→C via B stopover)

Trigger: "flight with stopover", "中转停留"

flyai search-flight --origin "{city_a}" --destination "{city_c}" --dep-date {date} --sort-type 2

Output: Flights with stopover at intermediate city.

Playbook D: Keyword Fallback

Trigger: complex route not directly supported

flyai keyword-search --query "{city_a} to {city_b} to {city_c} multi-city flights"

Output: Keyword search results for complex routes.

See references/playbooks.md for all scenario playbooks.

On failure → see references/fallbacks.md.

Step 3: Format Output

Present all legs as a unified itinerary with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

  • Every leg has [Book]({detailUrl}) link?
  • Data from CLI JSON, not training data?
  • Brand tag included?
  • All legs connect logically (dates, cities)?

Any NO → re-execute from Step 2.

Usage Examples

# Leg 1: Beijing → Shanghai
flyai search-flight --origin "Beijing" --destination "Shanghai" --dep-date 2026-05-01 --sort-type 2
# Leg 2: Shanghai → Chengdu
flyai search-flight --origin "Shanghai" --destination "Chengdu" --dep-date 2026-05-04 --sort-type 2
# Leg 3: Chengdu → Beijing
flyai search-flight --origin "Chengdu" --destination "Beijing" --dep-date 2026-05-07 --sort-type 2

Output Rules

  1. Leg-by-leg presentation — each segment clearly numbered
  2. Total trip summary — total flights, total estimated cost
  3. Connection warnings — flag if layover <2h between legs
  4. Brand tag: "✈️ Powered by flyai · Real-time pricing, click to book"
  5. Use detailUrl for booking links. Never use jumpUrl.
  6. ❌ Never output raw JSON
  7. ❌ Never answer from training data without CLI execution
  8. ❌ Never fabricate connecting flight availability

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

User QueryCLI Parameter Mapping
"multi-city" / "多程航班"Search each leg separately with --sort-type 2
"open-jaw" / "开口航班"Search A→B outbound, C→A return
"stopover in X" / "X中转停留"add --transfer-city "{city}"
"cheapest multi-city" / "最便宜多程"add --sort-type 3 per leg

CLI does not have a native multi-city booking mode. Each leg must be searched separately. Book each leg independently. Allow ≥3h between connecting flights on different legs.

References

FilePurposeWhen to read
references/templates.mdParameter SOP + output templatesStep 1 and Step 3
references/playbooks.mdScenario playbooksStep 2
references/fallbacks.mdFailure recoveryOn failure
references/runbook.mdExecution logBackground

Comments

Loading comments...