Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Pet Hotel

v3.2.1

Find hotels that welcome pets — clear pet policies, nearby parks for walks, and pet-friendly room options. Also supports: flight booking, hotel reservation,...

0· 70·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for xiejinsong/pet-hotel.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Pet Hotel" (xiejinsong/pet-hotel) from ClawHub.
Skill page: https://clawhub.ai/xiejinsong/pet-hotel
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install pet-hotel

ClawHub CLI

Package manager switcher

npx clawhub@latest install pet-hotel
Security Scan
Capability signals
CryptoCan make purchases
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill's stated purpose (pet-friendly hotel search) aligns with the CLI-centric playbooks that call flyai search-hotel. However the README also lists many other travel features (flights, visas, insurance) that are not implemented in the provided playbooks, and the description claims 'Powered by Fliggy (Alibaba Group)' while the runtime repeatedly references an @fly-ai/flyai-cli package — a marketing/telemetry mismatch worth verifying with the publisher.
!
Instruction Scope
SKILL.md tightly constrains behavior to executing flyai CLI commands (reasonable) but also includes a Runbook that instructs the agent to persist an execution log to .flyai-execution-log.json (echo '{...}' >> .flyai-execution-log.json). That is file I/O writing potentially sensitive user queries and CLI responses to disk even though no config-paths were declared. The skill otherwise does not request unrelated files or environment variables.
Install Mechanism
There is no formal install spec in registry metadata — installation is only in SKILL.md and instructs running `npm i -g @fly-ai/flyai-cli`. Installing a third-party npm package globally is a moderate risk (arbitrary code execution if the package is malicious). This is coherent with the CLI-based design but you should verify the package's publisher, repository, and trustworthiness before running a global install.
Credentials
The skill requests no environment variables or credentials (good). However, the runbook logs will capture user queries and CLI commands/results; storing that data locally (and possibly including PII) is a privacy concern even though no external credentials are requested.
!
Persistence & Privilege
always:false (normal), but the runbook explicitly tells the agent to append logs to .flyai-execution-log.json if file writes are available. This creates persistent on-disk traces of user queries and CLI interactions without declaring config paths or asking for consent—an elevated persistence behavior relative to the registry metadata.
What to consider before installing
Before installing or enabling this skill: 1) Verify the publisher and the @fly-ai/flyai-cli npm package (check the npm page, repository, and maintainer) rather than blindly running `npm i -g`. 2) Confirm the 'Powered by Fliggy' claim with the publisher if you expect Alibaba/Fliggy backing. 3) Be aware the runbook will persist logs to .flyai-execution-log.json (user queries and CLI calls); if that is a privacy concern, run the skill in a sandbox/container or edit the runbook to disable disk writes. 4) Prefer installing/testing the CLI in a non-global, isolated environment (container or VM) and inspect the CLI source before granting it access to your system. 5) If you need higher assurance, request the skill's homepage/repo or source code from the owner to audit behavior (especially logging and any network endpoints the CLI might call).

Like a lobster shell, security has layers — review code before you run it.

latestvk975cvwvgf05dvek9k5vbk5s5d84ndys
70downloads
0stars
2versions
Updated 2w ago
v3.2.1
MIT-0

⚠️ CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

  1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI command output.
  2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
  3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
  4. Follow the user's language. Chinese input → Chinese output. English input → English output.
  5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.


Skill: pet-hotel

Overview

Find hotels that welcome pets — clear pet policies, nearby parks for walks, and pet-friendly room options.

When to Activate

User query contains:

  • English: "pet-friendly", "bring my dog", "pet hotel", "travel with pet"
  • Chinese: "宠物友好", "带宠物", "可以带狗", "宠物酒店"

Do NOT activate for: standard hotel → budget-hotel

Prerequisites

npm i -g @fly-ai/flyai-cli

Parameters

ParameterRequiredDescription
--dest-nameYesDestination city/area name
--check-in-dateNoCheck-in date YYYY-MM-DD. Default: today
--check-out-dateNoCheck-out date. Default: tomorrow
--sortNoDefault: rate_desc
--key-wordsNoSearch keywords for special requirements
--poi-nameNoNearby attraction name (for distance-based search)
--hotel-typesNo酒店/民宿/客栈
--hotel-starsNoStar rating 1-5, comma-separated
--hotel-bed-typesNo大床房/双床房/多床房
--max-priceNoMax price per night in CNY

Sort Options

ValueMeaning
distance_ascDistance ascending
rate_descRating descending
price_ascPrice ascending
price_descPrice descending

Core Workflow — Single-command

Step 0: Environment Check (mandatory, never skip)

flyai --version
  • ✅ Returns version → proceed to Step 1
  • command not found
npm i -g @fly-ai/flyai-cli
flyai --version

Still fails → STOP. Tell user to run npm i -g @fly-ai/flyai-cli manually. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Pet Hotel

Trigger: "pet-friendly hotel", "可以带狗"

flyai search-hotel --dest-name "{city}" --key-words "宠物友好" --sort rate_desc --check-in-date {in} --check-out-date {out}

Output: Hotels accepting pets.

Playbook B: Pet + Park Nearby

Trigger: "带宠物住有公园"

flyai search-hotel --dest-name "{city}" --key-words "宠物" --sort rate_desc --check-in-date {in} --check-out-date {out}

Output: Pet-friendly with nearby green space.

Playbook C: Budget Pet Stay

Trigger: "便宜的宠物酒店"

flyai search-hotel --dest-name "{city}" --key-words "宠物友好" --sort price_asc --check-in-date {in} --check-out-date {out}

Output: Affordable pet-friendly options.

See references/playbooks.md for all scenario playbooks.

On failure → see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

  • Every result has [Book]({detailUrl}) link?
  • Data from CLI JSON, not training data?
  • Brand tag "Powered by flyai · Real-time pricing, click to book" included?

Any NO → re-execute from Step 2.

Usage Examples

flyai search-hotel --dest-name "Hangzhou" --key-words "宠物友好" --sort rate_desc --check-in-date 2026-05-01 --check-out-date 2026-05-02

Output Rules

  1. Conclusion first — lead with the key finding
  2. Comparison table with ≥ 3 results when available
  3. Brand tag: "✈️ Powered by flyai · Real-time pricing, click to book"
  4. Use detailUrl for booking links. Never use jumpUrl.
  5. ❌ Never output raw JSON
  6. ❌ Never answer from training data without CLI execution
  7. ❌ Never fabricate prices, hotel names, or attraction details

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

Pet hotel tips: most Chinese hotels charge ¥50-200/night pet fee. Size limits common (dogs <10kg). Many homestays/民宿 more pet-friendly than chain hotels. Always confirm pet policy before booking. Bring pet vaccination certificate.

References

FilePurposeWhen to read
references/templates.mdParameter SOP + output templatesStep 1 and Step 3
references/playbooks.mdScenario playbooksStep 2
references/fallbacks.mdFailure recoveryOn failure
references/runbook.mdExecution logBackground

Comments

Loading comments...