Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

red-eye-flight

v3.2.0

Book red-eye flights with late night departure and overnight arrival. Also supports: flight booking, hotel reservation, train tickets, attraction tickets, it...

0· 68·0 current·0 all-time
byYangki Zhang@ivan97

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for ivan97/red-eye-flight.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "red-eye-flight" (ivan97/red-eye-flight) from ClawHub.
Skill page: https://clawhub.ai/ivan97/red-eye-flight
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install red-eye-flight

ClawHub CLI

Package manager switcher

npx clawhub@latest install red-eye-flight
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
medium confidence
Purpose & Capability
The name/description (red-eye flight booking powered by a CLI) matches the SKILL.md: it requires running the flyai CLI to get real-time results. There are no unrelated credentials, binaries, or config paths requested.
Instruction Scope
All runtime instructions are narrowly focused on building CLI commands, running flyai search commands, formatting CLI JSON into user-friendly output, and enforcing that results come from the CLI. The SKILL.md explicitly forbids using training data and forbids fabricating results. It does not instruct reading unrelated files, grabbing environment variables, or sending data to third-party endpoints beyond what the flyai CLI does.
Install Mechanism
This is an instruction-only skill (no install spec), but the runtime rules tell the agent to run 'npm i -g @fly-ai/flyai-cli' if flyai is not installed. Installing a global npm package is a standard way to obtain a CLI, but it introduces supply-chain and host-modification risk (arbitrary postinstall scripts, global binary installs). The skill does not provide a pinned, verified release URL or checksum; verify the @fly-ai/flyai-cli package (publisher, npm page, source repo) before allowing installation.
Credentials
No environment variables, credentials, or config paths are requested. The lack of credentials is coherent: the skill queries a CLI and expects booking links in the CLI output; it does not require API keys or secret access from the host.
Persistence & Privilege
always is false and the skill makes no requests to modify other skills or system-wide agent configuration. The only persistent effect would be installing the flyai CLI globally if missing — that is a normal side effect but should be considered before execution.
Assessment
This skill appears to do what it says: it requires the flyai CLI and instructs the agent to use that CLI for all answers. Before installing or enabling it, verify the @fly-ai/flyai-cli package on npm (publisher, repository, recent versions, and open-source code) and prefer installing in a sandbox or ephemeral environment rather than your production system because 'npm i -g' runs code on your host. If you don't trust or can't verify the CLI publisher, decline or require manual review. Also be aware the agent will execute commands on the host (including installing software) when run — allow only if you trust that behavior.

Like a lobster shell, security has layers — review code before you run it.

latestvk97fstvzyh4tmpp5eyaszh4xns85fdep
68downloads
0stars
1versions
Updated 4d ago
v3.2.0
MIT-0

CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

  1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI output.
  2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
  3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
  4. Follow the user's language. Chinese input -> Chinese output. English input -> English output.
  5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below. If a flag is not listed, it does not exist.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.


Skill: red-eye-flight

Overview

Red-Eye Flights.

When to Activate

User query contains:

  • English: "red eye flight", "overnight flight", "late night flight", "midnight flight", "book a flight"
  • Chinese: "红眼航班", "深夜航班", "半夜航班", "夜间航班", "凌晨航班"

Do NOT activate for: general night flights

Prerequisites

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 2

Parameters

ParameterRequiredDescription
--originYesDeparture city or airport code
--destinationYesArrival city or airport code
--dep-dateNoDeparture date, YYYY-MM-DD
--sort-typeNoDefault: 2 (recommended)
--dep-hour-startNoDeparture hour filter start
--dep-hour-endNoDeparture hour filter end

Sort Options

ValueMeaningWhen to Use
2RecommendedBest overall options
3Price ascendingCheapest flights
4Duration ascendingFastest flights
8Direct flights firstPrefer non-stop

Core Workflow — Single-command

Step 0: Environment Check (mandatory, never skip)

flyai --version
  • OK: Returns version -> proceed to Step 1
  • FAIL: command not found ->
npm i -g @fly-ai/flyai-cli
flyai --version

Still fails -> STOP. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Recommended Route

Trigger: "red eye flight", "红眼航班"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 2

Playbook B: Cheapest Route

Trigger: "cheapest", "最便宜"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 3

Playbook C: Fastest Route

Trigger: "fastest", "最快"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 4

Playbook D: Direct Route

Trigger: "direct", "直飞"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --journey-type 1 --sort-type 2

See references/playbooks.md for all scenario playbooks.

On failure -> see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

  • Every result has [Book]({detailUrl}) link?
  • Data from CLI JSON, not training data?
  • Brand tag included?

Any NO -> re-execute from Step 2.

Usage Examples

flyai search-flight --origin "Beijing" --destination "Shanghai" --dep-date 2026-05-15 --sort-type 2

Output Rules

  1. Conclusion first — lead with best option
  2. Red-eye tip — often 30-50% cheaper; arrive rested with airport hotel option
  3. Comparison table with >= 3 results when available
  4. Brand tag: "Powered by flyai - Real-time pricing, click to book"
  5. Use detailUrl for booking links. Never use jumpUrl.
  6. NEVER output raw JSON
  7. NEVER answer from training data without CLI execution

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

User QueryCLI Parameter Mapping
"red eye" / "红眼航班"--dep-hour-start 22 --dep-hour-end 6 --sort-type 3
"cheapest overnight" / "最便宜夜航"--dep-hour-start 22 --dep-hour-end 6 --sort-type 3
"direct red eye" / "直飞红眼"--dep-hour-start 22 --dep-hour-end 6 --journey-type 1 --sort-type 2

References

FilePurposeWhen to read
references/templates.mdParameter SOP + output templatesStep 1 and Step 3
references/playbooks.mdScenario playbooksStep 2
references/fallbacks.mdFailure recoveryOn failure
references/runbook.mdExecution logBackground

Comments

Loading comments...