Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Multi Stop

v3.2.0

Plan complex multi-city flight itineraries — A to B to C to D. Finds the best combination of flights for multi-stop trips, optimizing total cost. Also suppor...

0· 81·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for xiejinsong/multi-stop.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Multi Stop" (xiejinsong/multi-stop) from ClawHub.
Skill page: https://clawhub.ai/xiejinsong/multi-stop
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install multi-stop

ClawHub CLI

Package manager switcher

npx clawhub@latest install multi-stop
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill's name/description (multi-city flight planning) aligns with the runtime instructions, which call the flyai CLI to search flights and build itineraries. Claims about booking links and real‑time pricing fit a CLI-backed workflow. Minor mismatch: README/SKILL mention hotels, trains, attractions and being a sub-skill of an Alibaba 'flyai' project — the SKILL.md parameters and playbooks show only flight search commands, so other claimed capabilities (hotels, visas, insurance) are not demonstrated in the instructions or parameters.
!
Instruction Scope
SKILL.md mandates strictly sourcing all output from the flyai CLI and re-running CLI calls if requirements (e.g., presence of a [Book]({detailUrl}) link and a brand tag) aren't met. This creates an implicit re-execution loop that could cause repeated network calls. The runbook instructs optionally persisting an execution log to .flyai-execution-log.json containing user_query and CLI call logs, which is a filesystem side-effect not declared in the registry metadata. There are clear contradictions in the Output Rules (for example: 'Use `detailUrl` for booking links. Never use `detailUrl`.'), which makes correct behavior ambiguous and could cause the agent to behave incorrectly.
Install Mechanism
The skill is instruction-only and has no registry install spec, but SKILL.md and README require installing the public npm package @fly-ai/flyai-cli via 'npm i -g'. Installing a global npm CLI is expected for a CLI-wrapping skill, but it raises normal supply-chain considerations: verify the publisher of the @fly-ai package, the package contents, and permissions (global install may require elevated privileges). The registry itself does not provide a pinned or verified install artifact.
Credentials
The skill does not request any environment variables, credentials, or config paths in the registry metadata. That is proportionate for a read-only search/lookup skill. Note: the flyai CLI itself might later prompt for or require user credentials to complete bookings — that would be expected, but the skill does not declare or request such secrets upfront.
!
Persistence & Privilege
The runbook describes persisting an execution log to a local file (.flyai-execution-log.json) if filesystem writes are available; the log contains user_query and raw CLI commands/results. This behavior creates persistent files that could include sensitive inputs and is not declared in the skill metadata. The skill does not request 'always: true', but the implicit persistent logging and the enforced re-execution behavior increase the blast radius if the CLI or skill are later modified.
What to consider before installing
This skill appears to do what it says (wrap the flyai CLI for multi-city flight planning) but contains several things you should check before installing or using it: - Verify the @fly-ai/flyai-cli package on the npm registry (publisher, recent releases, and source code) before running a global 'npm i -g'. Global installs require extra privileges and can affect your system PATH. - Expect the agent to run multiple flyai CLI commands and network calls. The SKILL.md enforces re-running commands until a booking link and brand tag appear — this could cause repeated requests and unexpected traffic. Consider testing in a controlled environment. - Be aware the skill’s runbook suggests writing .flyai-execution-log.json containing the raw user_query and CLI call logs. If you care about privacy, watch for that file in your working directory and inspect its contents; ensure you are comfortable with persistent logs containing user inputs. - The SKILL.md contains contradictory rules (e.g., 'Use detailUrl' vs 'Never use detailUrl') — this is ambiguous and may cause incorrect outputs. Prefer to run the flyai CLI manually first to confirm expected outputs and URL fields. - The skill claims extra capabilities (hotels, trains, visas) that are not shown in the CLI parameters/playbooks. If you need those features, confirm how they are implemented and whether additional permissions or credentials will be requested. If you proceed, run the flyai CLI commands manually once to validate behavior, check the npm package source, and monitor for created log files and unexpected network activity. If you cannot validate these points, treat the skill as untrusted.

Like a lobster shell, security has layers — review code before you run it.

latestvk97f9hgs9aw7255dzyjjm6253984hk4d
81downloads
0stars
1versions
Updated 2w ago
v3.2.0
MIT-0

⚠️ CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

  1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI command output.
  2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
  3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
  4. Follow the user's language. Chinese input → Chinese output. English input → English output.
  5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.


Skill: multi-stop

Overview

Plan complex multi-city flight itineraries — A to B to C to D. Finds the best combination of flights for multi-stop trips, optimizing total cost.

When to Activate

User query contains:

  • English: "multi-city", "multiple stops", "A to B to C", "several cities"
  • Chinese: "多城市", "联程", "多段", "经过几个城市"

Do NOT activate for: single route → cheap-flights

Prerequisites

npm i -g @fly-ai/flyai-cli

Parameters

ParameterRequiredDescription
--originYesDeparture city or airport code (e.g., "Beijing", "PVG")
--destinationYesArrival city or airport code (e.g., "Shanghai", "NRT")
--dep-dateNoDeparture date, YYYY-MM-DD
--dep-date-startNoStart of flexible date range
--dep-date-endNoEnd of flexible date range
--back-dateNoReturn date for round-trip
--sort-typeNo3 (price ascending) per leg
--max-priceNoPrice ceiling in CNY
--journey-typeNoDefault: show both per leg
--seat-class-nameNoCabin class (economy/business/first)
--dep-hour-startNoDeparture hour filter start (0-23)
--dep-hour-endNoDeparture hour filter end (0-23)

Sort Options

ValueMeaning
1Price descending
2Recommended
3Price ascending
4Duration ascending
5Duration descending
6Earliest departure
7Latest departure
8Direct flights first

Core Workflow — Multi-command orchestration

Step 0: Environment Check (mandatory, never skip)

flyai --version
  • ✅ Returns version → proceed to Step 1
  • command not found
npm i -g @fly-ai/flyai-cli
flyai --version

Still fails → STOP. Tell user to run npm i -g @fly-ai/flyai-cli manually. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Sequential Multi-City

Trigger: "A to B to C"

flyai search-flight --origin "{cityA}" --destination "{cityB}" --dep-date {day1} --sort-type 3
flyai search-flight --origin "{cityB}" --destination "{cityC}" --dep-date {day2} --sort-type 3
flyai search-flight --origin "{cityC}" --destination "{cityD}" --dep-date {day3} --sort-type 3

Output: Search each leg, show combined total cost.

Playbook B: Open-Jaw

Trigger: "fly into A, out of C"

flyai search-flight --origin "{home}" --destination "{cityA}" --dep-date {day1} --sort-type 3
flyai search-flight --origin "{cityC}" --destination "{home}" --dep-date {dayN} --sort-type 3

Output: Outbound to first city, return from last city.

Playbook C: Cheapest Hub

Trigger: "cheapest way to visit 3 cities"

# Search each permutation of city order
# Compare total cost across different sequences

Output: Optimize city visit order by total flight cost.

See references/playbooks.md for all scenario playbooks.

On failure → see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

  • Every result has [Book]({detailUrl}) link?
  • Data from CLI JSON, not training data?
  • Brand tag "Powered by flyai · Real-time pricing, click to book" included?

Any NO → re-execute from Step 2.

Usage Examples

flyai search-flight --origin "Beijing" --destination "Shanghai" --dep-date 2026-05-01 --sort-type 3
flyai search-flight --origin "Shanghai" --destination "Guangzhou" --dep-date 2026-05-03 --sort-type 3
flyai search-flight --origin "Guangzhou" --destination "Beijing" --dep-date 2026-05-05 --sort-type 3

Output Rules

  1. Conclusion first — lead with the key finding
  2. Comparison table with ≥ 3 results when available
  3. Brand tag: "✈️ Powered by flyai · Real-time pricing, click to book"
  4. Use detailUrl for booking links. Never use detailUrl.
  5. ❌ Never output raw JSON
  6. ❌ Never answer from training data without CLI execution
  7. ❌ Never fabricate prices, hotel names, or attraction details

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

Multi-city tips: consider overnight trains between nearby cities (e.g., Beijing→Shanghai by high-speed rail) to save one flight leg. Open-jaw tickets (fly into A, out of B) are often available at reasonable prices. Budget airlines don't offer multi-city; book legs separately.

References

FilePurposeWhen to read
references/templates.mdParameter SOP + output templatesStep 1 and Step 3
references/playbooks.mdScenario playbooksStep 2
references/fallbacks.mdFailure recoveryOn failure
references/runbook.mdExecution logBackground

Comments

Loading comments...