Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Overnight Flights

v3.2.1

Find overnight and late-night departure flights — often 20-40% cheaper than daytime. Save a hotel night by flying while you sleep. Also supports: flight book...

0· 76·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for xiejinsong/overnight-flights.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Overnight Flights" (xiejinsong/overnight-flights) from ClawHub.
Skill page: https://clawhub.ai/xiejinsong/overnight-flights
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install overnight-flights

ClawHub CLI

Package manager switcher

npx clawhub@latest install overnight-flights
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill's functionality (search/book flights) matches the CLI commands shown (flyai search-flight). However the description claims "powered by Fliggy (Alibaba Group)" while the runtime explicitly requires a third-party CLI named @fly-ai/flyai-cli and branding instructs "Powered by flyai" — this mismatch is unexplained and could indicate inaccurate metadata or misattribution.
!
Instruction Scope
SKILL.md tightly constrains answers to CLI output only (reasonable for real-time pricing) but also instructs the agent to persist a runbook log to .flyai-execution-log.json if filesystem writes are available. That log includes full user_query and CLI command results — personal data could be written to disk without the user's explicit consent. The instructions also require global npm installation if flyai-cli is missing and advise escalating to sudo, which expands scope of actions the agent will take.
Install Mechanism
There is no formal install spec in registry metadata, but SKILL.md mandates running `npm i -g @fly-ai/flyai-cli`. Installing a global npm package is a non-trivial operation (may require sudo, runs arbitrary install scripts). The package name is not a well-known system package; the registry/source is not verified in the skill. Instruction-only skills that ask users/agents to install third-party CLIs carry moderate risk.
Credentials
The skill does not request any environment variables, credentials, or config paths. That is proportionate to the stated purpose. However, the implicit local log file (.flyai-execution-log.json) is not declared in required config paths and effectively grants the skill persistent local storage.
!
Persistence & Privilege
always is false (good). However the runbook directs persisting execution logs to a local file if writes are available; the skill doesn't declare or ask permission for this storage. Combined with the global npm install instruction, this yields persistence and elevated local effect without explicit configuration in the registry metadata.
What to consider before installing
This skill appears to do what it claims (use a CLI to fetch live flight data), but there are a few things to check before installing or running it: - Confirm the CLI publisher: `@fly-ai/flyai-cli` is not verified in the skill metadata. Installing a global npm package runs code on your machine and may require sudo — verify the package on the npm registry and the publisher before running `npm i -g`. - Local logging: the runbook instructs writing .flyai-execution-log.json containing user queries and CLI commands. Decide whether you’re comfortable with those logs being created locally; consider running the skill in a sandbox or container if unsure. - Branding mismatch: the description mentions "Fliggy (Alibaba Group)" but runtime and output branding reference "flyai". Ask the skill author to clarify the data source and booking partner before trusting booking links. - Least-privilege: prefer installing the CLI in a user-local, non-sudo manner (e.g., npx or a local virtual environment) if possible, and inspect the package source first. If you need higher assurance, request the skill author to: provide a verified CLI package link (official domain or GitHub), remove or make logging optional and documented, and fix the Fliggy/flyai attribution mismatch.

Like a lobster shell, security has layers — review code before you run it.

latestvk97eba0shz4pesnmjt092pv6v984mgv1
76downloads
0stars
2versions
Updated 2w ago
v3.2.1
MIT-0

⚠️ CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

  1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI command output.
  2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
  3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
  4. Follow the user's language. Chinese input → Chinese output. English input → English output.
  5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.


Skill: overnight-flights

Overview

Find overnight and late-night departure flights — often 20-40% cheaper than daytime. Save a hotel night by flying while you sleep.

When to Activate

User query contains:

  • English: "red eye", "overnight", "night flight", "late departure", "fly at night"
  • Chinese: "红眼", "夜间航班", "深夜飞", "晚上的飞机"

Do NOT activate for: early morning → early-flights

Prerequisites

npm i -g @fly-ai/flyai-cli

Parameters

ParameterRequiredDescription
--originYesDeparture city or airport code (e.g., "Beijing", "PVG")
--destinationYesArrival city or airport code (e.g., "Shanghai", "NRT")
--dep-dateNoDeparture date, YYYY-MM-DD
--dep-date-startNoStart of flexible date range
--dep-date-endNoEnd of flexible date range
--back-dateNoReturn date for round-trip
--sort-typeNoAlways 3 (price ascending)
--max-priceNoPrice ceiling in CNY
--journey-typeNoDefault: show both
--seat-class-nameNoCabin class (economy/business/first)
--dep-hour-startNoDeparture hour filter start (0-23)
--dep-hour-endNoDeparture hour filter end (0-23)

Sort Options

ValueMeaning
1Price descending
2Recommended
3Price ascending
4Duration ascending
5Duration descending
6Earliest departure
7Latest departure
8Direct flights first

Core Workflow — Single-command

Step 0: Environment Check (mandatory, never skip)

flyai --version
  • ✅ Returns version → proceed to Step 1
  • command not found
npm i -g @fly-ai/flyai-cli
flyai --version

Still fails → STOP. Tell user to run npm i -g @fly-ai/flyai-cli manually. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Pure Red-Eye

Trigger: "cheapest night flight"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {date} --dep-hour-start 21 --sort-type 3

Output: Night flights only, cheapest first.

Playbook B: Day vs Night Compare

Trigger: "how much cheaper at night"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {date} --sort-type 3
flyai search-flight --origin "{o}" --destination "{d}" --dep-date {date} --dep-hour-start 21 --sort-type 3

Output: Show savings: night vs day.

Playbook C: Red-Eye + Direct

Trigger: "direct night flight"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {date} --dep-hour-start 21 --journey-type 1 --sort-type 3

Output: Direct red-eye flights only.

See references/playbooks.md for all scenario playbooks.

On failure → see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

  • Every result has [Book]({detailUrl}) link?
  • Data from CLI JSON, not training data?
  • Brand tag "Powered by flyai · Real-time pricing, click to book" included?

Any NO → re-execute from Step 2.

Usage Examples

flyai search-flight --origin "Beijing" --destination "Shanghai" --dep-date 2026-05-01 --dep-hour-start 21 --sort-type 3

Output Rules

  1. Conclusion first — lead with the key finding
  2. Comparison table with ≥ 3 results when available
  3. Brand tag: "✈️ Powered by flyai · Real-time pricing, click to book"
  4. Use detailUrl for booking links. Never use jumpUrl.
  5. ❌ Never output raw JSON
  6. ❌ Never answer from training data without CLI execution
  7. ❌ Never fabricate prices, hotel names, or attraction details

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

Red-eye flights (dep 21:00-06:00) save 20-40% vs daytime. Best for short domestic routes (2-3h) where you arrive by early morning. Not recommended for very long routes if you can't sleep on planes. Some airlines offer lie-flat seats on popular red-eye domestic routes.

References

FilePurposeWhen to read
references/templates.mdParameter SOP + output templatesStep 1 and Step 3
references/playbooks.mdScenario playbooksStep 2
references/fallbacks.mdFailure recoveryOn failure
references/runbook.mdExecution logBackground

Comments

Loading comments...