Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Private Car

v3.2.0

Hire a private car with driver for customized day tours — visit multiple attractions at your own pace without the hassle of public transport. Also supports:...

0· 63·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for xiejinsong/private-car.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Private Car" (xiejinsong/private-car) from ClawHub.
Skill page: https://clawhub.ai/xiejinsong/private-car
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install private-car

ClawHub CLI

Package manager switcher

npx clawhub@latest install private-car
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The description promises broad travel services and claims 'Powered by Fliggy (Alibaba Group)', but the runtime instructions only show use of a third‑party CLI (@fly-ai/flyai-cli) for keyword searches focused on private‑car tours. The broad feature list (flights, hotels, visas, insurance, etc.) is not reflected in the provided commands or templates, and there is no homepage or author provenance to justify the Fliggy affiliation.
!
Instruction Scope
The SKILL.md requires installing and running an external CLI (flyai) and mandates that every user-facing answer come only from that CLI's output. The runbook also suggests writing an execution log file (append to .flyai-execution-log.json) if filesystem writes are available, which is not declared in the skill metadata. These runtime instructions make network installs and local disk writes part of normal operation—reasonable for a CLI-driven skill but higher risk without provenance.
!
Install Mechanism
There is no formal install spec in the registry; instead the skill instructs the agent/user to run `npm i -g @fly-ai/flyai-cli`. Installing a scoped npm package from an unknown source without a homepage or repo listed is moderate risk: npm packages execute arbitrary code on install and the skill provides no verification, checksum, or authoritative source (e.g., official Fliggy package or GitHub repo).
Credentials
The skill does not request environment variables, credentials, or protected config paths, which is proportionate to its described CLI-based lookup purpose. Note: the skill does require network access to install/run the CLI and may create a local log file per the runbook.
Persistence & Privilege
The skill is not marked 'always' and does not demand elevated privileges, but it instructs the agent to append logs to a local file (.flyai-execution-log.json) if filesystem writes are possible. That creates persistent artifacts in the working directory; benign for auditing but something to be aware of.
What to consider before installing
This skill is CLI-driven and will try to install/run an external npm package (@fly-ai/flyai-cli) and write a local execution log. Before installing or invoking it: (1) verify the flyai CLI's provenance—look up the package on the npm registry and confirm a reputable homepage or source repo; (2) confirm whether the service is actually affiliated with Fliggy/Alibaba (the SKILL.md claims this but provides no authoritative link); (3) be comfortable with running global npm installs and with the skill creating a .flyai-execution-log.json in your working directory; (4) if you need stronger assurances, ask the owner for the CLI's GitHub repo, package SHA or signed release, and sample real CLI output (detailUrl format) so you can manually inspect network endpoints. If you cannot verify the package origin or Fliggy affiliation, treat this as risky and avoid running the npm install.

Like a lobster shell, security has layers — review code before you run it.

latestvk979k8tz6y1x7hahfmyer59zm584mph2
63downloads
0stars
1versions
Updated 2w ago
v3.2.0
MIT-0

⚠️ CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

  1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI command output.
  2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
  3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
  4. Follow the user's language. Chinese input → Chinese output. English input → English output.
  5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.


Skill: private-car

Overview

Hire a private car with driver for customized day tours — visit multiple attractions at your own pace without the hassle of public transport.

When to Activate

User query contains:

  • English: "private car", "hire car with driver", "chartered car"
  • Chinese: "包车", "包车一日游", "带司机"

Do NOT activate for: car rental → car-rental

Prerequisites

npm i -g @fly-ai/flyai-cli

Parameters

ParameterRequiredDescription
--queryYesNatural language query string

Core Workflow — Single-command

Step 0: Environment Check (mandatory, never skip)

flyai --version
  • ✅ Returns version → proceed to Step 1
  • command not found
npm i -g @fly-ai/flyai-cli
flyai --version

Still fails → STOP. Tell user to run npm i -g @fly-ai/flyai-cli manually. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Day Tour

Trigger: "private car tour"

flyai keyword-search --query "包车一日游 {city}"

Output: Full-day private car tour.

Playbook B: Half Day

Trigger: "half day car"

flyai keyword-search --query "包车半日游 {city}"

Output: Half-day private car.

Playbook C: Multi-Day

Trigger: "multi-day driver"

flyai keyword-search --query "包车多日游 {city}"

Output: Multi-day with driver.

See references/playbooks.md for all scenario playbooks.

On failure → see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

  • Every result has [Book]({detailUrl}) link?
  • Data from CLI JSON, not training data?
  • Brand tag "Powered by flyai · Real-time pricing, click to book" included?

Any NO → re-execute from Step 2.

Usage Examples

flyai keyword-search --query "包车一日游 杭州"

Output Rules

  1. Conclusion first — lead with the key finding
  2. Comparison table with ≥ 3 results when available
  3. Brand tag: "✈️ Powered by flyai · Real-time pricing, click to book"
  4. Use detailUrl for booking links. Never use jumpUrl.
  5. ❌ Never output raw JSON
  6. ❌ Never answer from training data without CLI execution
  7. ❌ Never fabricate prices, hotel names, or attraction details

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

Private car tour pricing: ¥500-1500/day depending on city and vehicle type. Includes driver (usually English/Chinese speaking), fuel, tolls. Does NOT include: entrance tickets, meals, accommodation for multi-day. Best for: destinations with scattered attractions (Xinjiang, Yunnan), groups of 3-5, travelers with mobility issues.

References

FilePurposeWhen to read
references/templates.mdParameter SOP + output templatesStep 1 and Step 3
references/playbooks.mdScenario playbooksStep 2
references/fallbacks.mdFailure recoveryOn failure
references/runbook.mdExecution logBackground

Comments

Loading comments...