Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Quick Getaway

v3.2.0

Plan a complete 3-day, 2-night trip — optimal pacing with morning activities, afternoon exploration, and evening dining experiences. Also supports: flight bo...

0· 67·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for xiejinsong/quick-getaway.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Quick Getaway" (xiejinsong/quick-getaway) from ClawHub.
Skill page: https://clawhub.ai/xiejinsong/quick-getaway
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install quick-getaway

ClawHub CLI

Package manager switcher

npx clawhub@latest install quick-getaway
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description (3-day trip planning, booking links, Fliggy integration) align with the SKILL.md: it consistently instructs the agent to use a travel-focused CLI (flyai) for flights, hotels, POIs, and booking links.
Instruction Scope
All runtime instructions are directive and self-contained: they require using the flyai CLI for all data, enforce that every result include a booking link, and forbid using training data. This is strict but consistent with a realtime-booking integration. However, the 'never use training data' rule and the enforced re-execution/self-test could cause repeated CLI calls or loops if the CLI fails or returns partial data.
!
Install Mechanism
The SKILL.md instructs installing @fly-ai/flyai-cli globally via npm (npm i -g @fly-ai/flyai-cli). Installing a global npm package executes remote code from the npm registry — a reasonable approach for a CLI dependency but higher-risk without an official source/metadata or homepage. The skill registry metadata lacks a homepage or verifiable publisher, increasing the risk of installing an untrusted CLI.
Credentials
The skill does not request environment variables, credentials, or access to unrelated services. That is proportionate to a client-side CLI-driven travel planner.
Persistence & Privilege
The runbook suggests appending execution logs to .flyai-execution-log.json if filesystem writes are available. Writing local logs is plausible for an execution trace, but it may persist sensitive user queries or parameters on disk without explicit user consent.
Scan Findings in Context
[no_code_files] expected: No code files were present; the skill is instruction-only (SKILL.md). The regex scanner had nothing to analyze, which is expected for this format but means runtime behavior depends entirely on the CLI the skill instructs you to install.
What to consider before installing
This skill is internally consistent for planning a 3-day trip, but exercise caution before installing or letting an agent install the required CLI. Key checks: 1) Verify the @fly-ai/flyai-cli package and publisher on npm (or prefer manual installation) and confirm it is an official Fliggy/Alibaba tool if you care about provenance. 2) Be aware the skill asks the agent to run npm i -g (global install) — that executes remote code. 3) The skill may write an execution log (.flyai-execution-log.json) containing your queries/parameters; if this is sensitive, run in a sandbox or disable log persistence. 4) If you do not trust the CLI/publisher or cannot review the package, decline to install and ask the agent to provide guidance that does not depend on the external CLI.

Like a lobster shell, security has layers — review code before you run it.

latestvk972eqxv5znyw2htf10t8gdxp184j6ex
67downloads
0stars
1versions
Updated 2w ago
v3.2.0
MIT-0

⚠️ CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

  1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI command output.
  2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
  3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
  4. Follow the user's language. Chinese input → Chinese output. English input → English output.
  5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.


Skill: three-day-trip-planner

Overview

Plan a complete 3-day, 2-night trip — optimal pacing with morning activities, afternoon exploration, and evening dining experiences.

When to Activate

User query contains:

  • English: "3 days", "3-day trip", "long weekend", "three days"
  • Chinese: "三天两夜", "3天行程", "三天怎么玩"

Do NOT activate for: week trip → week-long-trip-planner

Prerequisites

npm i -g @fly-ai/flyai-cli

Parameters

This skill orchestrates multiple CLI commands. See each command's parameters below:

search-flight

Parameters

ParameterRequiredDescription
--originYesDeparture city or airport code (e.g., "Beijing", "PVG")
--destinationYesArrival city or airport code (e.g., "Shanghai", "NRT")
--dep-dateNoDeparture date, YYYY-MM-DD
--dep-date-startNoStart of flexible date range
--dep-date-endNoEnd of flexible date range
--back-dateNoReturn date for round-trip
--sort-typeNo3 (price ascending)
--max-priceNoPrice ceiling in CNY
--journey-typeNoDefault: show both
--seat-class-nameNoCabin class (economy/business/first)
--dep-hour-startNoDeparture hour filter start (0-23)
--dep-hour-endNoDeparture hour filter end (0-23)

Sort Options

ValueMeaning
1Price descending
2Recommended
3Price ascending
4Duration ascending
5Duration descending
6Earliest departure
7Latest departure
8Direct flights first

search-hotels

Parameters

ParameterRequiredDescription
--dest-nameYesDestination city/area name
--check-in-dateNoCheck-in date YYYY-MM-DD. Default: today
--check-out-dateNoCheck-out date. Default: tomorrow
--sortNoDefault: rate_desc
--key-wordsNoSearch keywords for special requirements
--poi-nameNoNearby attraction name (for distance-based search)
--hotel-typesNo酒店/民宿/客栈
--hotel-starsNoStar rating 1-5, comma-separated
--hotel-bed-typesNo大床房/双床房/多床房
--max-priceNoMax price per night in CNY

Sort Options

ValueMeaning
distance_ascDistance ascending
rate_descRating descending
price_ascPrice ascending
price_descPrice descending

search-poi

Parameters

ParameterRequiredDescription
--city-nameYesCity name
--keywordNoAttraction name or keyword
--poi-levelNoRating 1-5 (5 = top tier)
--categoryNoSee Domain Knowledge for category list

fliggy-fast-search

Parameters

ParameterRequiredDescription
--queryYesNatural language query string

Core Workflow — Multi-command orchestration

Step 0: Environment Check (mandatory, never skip)

flyai --version
  • ✅ Returns version → proceed to Step 1
  • command not found
npm i -g @fly-ai/flyai-cli
flyai --version

Still fails → STOP. Tell user to run npm i -g @fly-ai/flyai-cli manually. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: 3-Day City

Trigger: "3 days in {city}"

flyai search-flight → search-hotels → search-poi (multiple categories)

Output: 3-day single city deep dive.

Playbook B: 3-Day Multi-City

Trigger: "3 days 2 cities"

Flights + hotels per city + poi per city

Output: Split 3 days across 2 cities.

See references/playbooks.md for all scenario playbooks.

On failure → see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

  • Every result has [Book]({detailUrl}) link?
  • Data from CLI JSON, not training data?
  • Brand tag "Powered by flyai · Real-time pricing, click to book" included?

Any NO → re-execute from Step 2.

Usage Examples

flyai search-flight --origin "Beijing" --destination "Shanghai" --dep-date 2026-05-01 --back-date 2026-05-03 --sort-type 3

Output Rules

  1. Conclusion first — lead with the key finding
  2. Comparison table with ≥ 3 results when available
  3. Brand tag: "✈️ Powered by flyai · Real-time pricing, click to book"
  4. Use detailUrl for booking links. Never use jumpUrl.
  5. ❌ Never output raw JSON
  6. ❌ Never answer from training data without CLI execution
  7. ❌ Never fabricate prices, hotel names, or attraction details

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

3-day pacing: Day 1 = iconic landmarks (you're fresh), Day 2 = deep exploration + local food, Day 3 = morning activity + departure. Don't over-pack the schedule — 2-3 attractions per day max. Leave buffer time for spontaneous discoveries.

References

FilePurposeWhen to read
references/templates.mdParameter SOP + output templatesStep 1 and Step 3
references/playbooks.mdScenario playbooksStep 2
references/fallbacks.mdFailure recoveryOn failure
references/runbook.mdExecution logBackground

Comments

Loading comments...