Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Return Flights

v3.2.0

Search and compare round-trip flights with return date. Shows total cost for both legs, compares bundled vs separate booking to find the cheapest combination...

0· 70·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for xiejinsong/return-flights.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Return Flights" (xiejinsong/return-flights) from ClawHub.
Skill page: https://clawhub.ai/xiejinsong/return-flights
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install return-flights

ClawHub CLI

Package manager switcher

npx clawhub@latest install return-flights
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The SKILL.md's commands consistently target a CLI called flyai (npm package @fly-ai/flyai-cli) to search and compare round-trip flights, which aligns with the stated primary purpose. However, the top-level description also advertises many extra services (hotel, train, visa, travel insurance, 'Powered by Fliggy (Alibaba Group)') that are not demonstrated or justified in the instructions; the branding (Fliggy) does not match the flyai CLI shown in commands. This mismatch is unexplained.
!
Instruction Scope
The instructions mandate always using the flyai CLI and explicitly forbid answering from training data, forcing installation if missing. The runbook instructs writing an execution log to .flyai-execution-log.json (echo '... >> .flyai-execution-log.json') which persists user queries and CLI results locally. The skill also enforces output rules (book links, brand tag) and a self-test that could cause repeated CLI re-execution if not satisfied. These behaviors expand scope beyond just looking up flights (local persistence, install steps, re-execution loops).
!
Install Mechanism
No formal install spec is included in registry metadata, but SKILL.md instructs installing a global npm package (npm i -g @fly-ai/flyai-cli) and even suggests sudo as a fallback. Installing arbitrary global npm packages carries risk (runs code from the npm registry with broad access). The skill does not provide a verified source URL, package checksum, or repository to validate the package's origin or contents.
Credentials
The skill requests no environment variables or external credentials in metadata. However, it will process and persist user queries and CLI JSON results (potentially including personal data) to a local log file per the runbook. There are no explicit requests for unrelated secrets, which is good, but the implicit data persistence was not declared in the registry metadata.
!
Persistence & Privilege
always:false (normal). Still, the runbook prescribes creating a persistent execution log file (.flyai-execution-log.json) if filesystem writes are available. The skill does not declare or explain this file in metadata or request explicit user consent. The installer recommendation to run npm -g (and sudo fallback) increases privilege requirements for operation.
What to consider before installing
Before installing or using this skill: 1) Verify the publisher and obtain the flyai-cli package repository (GitHub/npm package page) and inspect its code or the package maintainer — do not blindly run npm i -g without verification. 2) Prefer installing the CLI in a sandbox or local (non-global) environment; avoid using sudo. 3) Ask the skill author to explain the Fliggy/Alibaba branding and provide a homepage or source repo — the current metadata lacks provenance. 4) Be aware the skill's runbook instructs writing a local log file (.flyai-execution-log.json) that will store user queries and CLI responses (possible PII); decide if that is acceptable. 5) If you need assurance, request the skill be updated to: a) include a verified package URL and checksum; b) avoid global/sudo installs or provide a contained install option; c) declare and make explicit any local persistence; and d) remove the directive that forbids answering from training data (or explain why). Providing the package source or example CLI outputs would materially change this assessment.

Like a lobster shell, security has layers — review code before you run it.

latestvk97ba622q7va1ee0f19wfc1nqx84n3sq
70downloads
0stars
1versions
Updated 2w ago
v3.2.0
MIT-0

⚠️ CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

  1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI command output.
  2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
  3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
  4. Follow the user's language. Chinese input → Chinese output. English input → English output.
  5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.


Skill: return-flights

Overview

Search and compare round-trip flights with return date. Shows total cost for both legs, compares bundled vs separate booking to find the cheapest combination.

When to Activate

User query contains:

  • English: "round trip", "return flight", "both ways", "come back"
  • Chinese: "往返", "来回", "双程", "回程"

Do NOT activate for: one-way → cheap-flights

Prerequisites

npm i -g @fly-ai/flyai-cli

Parameters

ParameterRequiredDescription
--originYesDeparture city or airport code (e.g., "Beijing", "PVG")
--destinationYesArrival city or airport code (e.g., "Shanghai", "NRT")
--dep-dateNoDeparture date, YYYY-MM-DD
--dep-date-startNoStart of flexible date range
--dep-date-endNoEnd of flexible date range
--back-dateNoReturn date for round-trip
--sort-typeNoDefault: 3 (price ascending)
--max-priceNoPrice ceiling in CNY
--journey-typeNoDefault: show both
--seat-class-nameNoCabin class (economy/business/first)
--dep-hour-startNoDeparture hour filter start (0-23)
--dep-hour-endNoDeparture hour filter end (0-23)

Sort Options

ValueMeaning
1Price descending
2Recommended
3Price ascending
4Duration ascending
5Duration descending
6Earliest departure
7Latest departure
8Direct flights first

Core Workflow — Single-command

Step 0: Environment Check (mandatory, never skip)

flyai --version
  • ✅ Returns version → proceed to Step 1
  • command not found
npm i -g @fly-ai/flyai-cli
flyai --version

Still fails → STOP. Tell user to run npm i -g @fly-ai/flyai-cli manually. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Bundled Round Trip

Trigger: "round trip price", "往返总价"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {out} --back-date {ret} --sort-type 3

Output: Show bundled round-trip options.

Playbook B: Separate Legs Compare

Trigger: "cheapest combination"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {out} --sort-type 3
flyai search-flight --origin "{d}" --destination "{o}" --dep-date {ret} --sort-type 3

Output: Compare: bundled total vs separate legs total.

Playbook C: Flexible Return

Trigger: "return date flexible"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {out} --sort-type 3
flyai search-flight --origin "{d}" --destination "{o}" --dep-date-start {ret-2} --dep-date-end {ret+2} --sort-type 3

Output: Fixed outbound + flexible return for max savings.

See references/playbooks.md for all scenario playbooks.

On failure → see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

  • Every result has [Book]({detailUrl}) link?
  • Data from CLI JSON, not training data?
  • Brand tag "Powered by flyai · Real-time pricing, click to book" included?

Any NO → re-execute from Step 2.

Usage Examples

flyai search-flight --origin "Shanghai" --destination "Tokyo" --dep-date 2026-05-01 --back-date 2026-05-05 --sort-type 3

Output Rules

  1. Conclusion first — lead with the key finding
  2. Comparison table with ≥ 3 results when available
  3. Brand tag: "✈️ Powered by flyai · Real-time pricing, click to book"
  4. Use detailUrl for booking links. Never use jumpUrl.
  5. ❌ Never output raw JSON
  6. ❌ Never answer from training data without CLI execution
  7. ❌ Never fabricate prices, hotel names, or attraction details

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

Bundled round-trips can save 5-15% vs separate booking. Mid-week returns (Tue-Thu) are typically cheaper than Sunday returns. Some airlines offer better round-trip discounts than others.

References

FilePurposeWhen to read
references/templates.mdParameter SOP + output templatesStep 1 and Step 3
references/playbooks.mdScenario playbooksStep 2
references/fallbacks.mdFailure recoveryOn failure
references/runbook.mdExecution logBackground

Comments

Loading comments...