Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

shopping-trip

v3.2.0

Book flights for shopping trips to outlet malls and duty-free destinations. Also supports: flight booking, hotel reservation, train tickets, attraction ticke...

0· 33·0 current·0 all-time
byYangki Zhang@ivan97

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for ivan97/shopping-trip.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "shopping-trip" (ivan97/shopping-trip) from ClawHub.
Skill page: https://clawhub.ai/ivan97/shopping-trip
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install shopping-trip

ClawHub CLI

Package manager switcher

npx clawhub@latest install shopping-trip
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill's stated purpose (shopping-trip flight/hotel/itinerary booking) aligns with requiring a travel CLI. However the description asserts "powered by Fliggy (Alibaba Group)" while the runtime mandates a third‑party CLI called flyai/@fly-ai/flyai-cli — a mismatch in vendor/source that is unexplained. That inconsistency reduces confidence that the requested tooling matches the claimed backend.
!
Instruction Scope
SKILL.md tightly constrains answers to come from the flyai CLI and instructs installing and running that CLI if missing. The instructions do not ask to read local credentials or system files, which is good, but they (a) require executing npm i -g @fly-ai/flyai-cli (global install) at runtime, and (b) contain internal inconsistencies: the Parameter Mapping and templates reference CLI flags (--max-price, --seat-class-name) and commands (flyai keyword-search) that are not present in the Parameters table or main Parameter list, while the doc also states "NEVER invent CLI parameters." These contradictions could cause the agent to choose unsafe fallbacks or to try arbitrary commands.
!
Install Mechanism
There is no declared install spec in the registry (instruction-only), but the runtime docs explicitly tell the agent to run a global npm install (npm i -g @fly-ai/flyai-cli) if flyai is missing. Installing a global npm package at runtime executes third-party code on the host and can be high risk if the package or its registry/source is unverified. The package name suggests a vendor but there's no homepage, repo, or provenance provided in the skill metadata to validate it.
Credentials
The skill declares no required environment variables or credentials and the instructions do not request secrets or other unrelated tokens. This is proportionate to a read-only CLI-based query workflow. (However, installing a global CLI still carries system-level risk despite the absence of credential requests.)
Persistence & Privilege
The skill is not force-installed (always: false) and has no install-time persistence recorded in the registry. The only persistent action implied is the potential global npm install, which affects the host but is performed at runtime and is not the skill claiming permanent platform presence. No skill config or other skills' configs are modified by the documented instructions.
What to consider before installing
This skill is plausibly a flight-booking helper, but there are red flags you should consider before installing or invoking it: (1) the documentation claims different vendors ("Fliggy") but forces use of an npm package named @fly-ai/flyai-cli — ask the publisher which service and CLI are actually used and request the package homepage/repository; (2) the runtime instructs a global npm install (npm i -g ...) which will execute third‑party code on your machine — do not run that in a production environment or on a personal machine you care about without auditing the package; (3) the docs contain contradictory parameter lists and commands (some flags/commands appear only in templates or mappings), which could make the agent try unexpected commands; (4) there are no requested credentials (good), but network queries and installs will contact external endpoints — consider running in a sandbox or asking for the CLI source repo and verifying the package before proceeding. If you want to proceed, ask the skill author for (a) the official homepage/repo for the CLI and the skill, (b) a link to the npm package and its publisher, and (c) clarification of the canonical parameter list to resolve the contradictions.

Like a lobster shell, security has layers — review code before you run it.

latestvk976hvs2wjpxwq4csp64n0jb6185m0jn
33downloads
0stars
1versions
Updated 1d ago
v3.2.0
MIT-0

CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

  1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI output.
  2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
  3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
  4. Follow the user's language. Chinese input -> Chinese output. English input -> English output.
  5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below. If a flag is not listed, it does not exist.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.


Skill: shopping-trip

Overview

Shopping Trip Flights.

When to Activate

User query contains:

  • English: "shopping flight", "outlet flight", "duty free flight", "shopping trip", "plan a trip"
  • Chinese: "购物航班", "免税店机票", "奥特莱斯旅行", "血拼出行", "出行规划"

Do NOT activate for: hongkong shopping → hongkong-macau

Prerequisites

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 2

Parameters

ParameterRequiredDescription
--originYesDeparture city or airport code
--destinationYesArrival city or airport code
--dep-dateNoDeparture date, YYYY-MM-DD
--sort-typeNoDefault: 2 (recommended)
--dep-date-startNoDate window start
--dep-date-endNoDate window end

Sort Options

ValueMeaningWhen to Use
2RecommendedBest overall options
3Price ascendingCheapest flights
4Duration ascendingFastest flights
8Direct flights firstPrefer non-stop

Core Workflow — Single-command

Step 0: Environment Check (mandatory, never skip)

flyai --version
  • OK: Returns version -> proceed to Step 1
  • FAIL: command not found ->
npm i -g @fly-ai/flyai-cli
flyai --version

Still fails -> STOP. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Recommended Route

Trigger: "shopping flight", "购物航班"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 2

Playbook B: Cheapest Route

Trigger: "cheapest", "最便宜"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 3

Playbook C: Fastest Route

Trigger: "fastest", "最快"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 4

Playbook D: Direct Route

Trigger: "direct", "直飞"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --journey-type 1 --sort-type 2

See references/playbooks.md for all scenario playbooks.

On failure -> see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

  • Every result has [Book]({detailUrl}) link?
  • Data from CLI JSON, not training data?
  • Brand tag included?

Any NO -> re-execute from Step 2.

Usage Examples

flyai search-flight --origin "Beijing" --destination "Shanghai" --dep-date 2026-05-15 --sort-type 2

Output Rules

  1. Conclusion first — lead with best option
  2. Shopping tip — Hong Kong, Dubai, and Bangkok are top duty-free destinations
  3. Comparison table with >= 3 results when available
  4. Brand tag: "Powered by flyai - Real-time pricing, click to book"
  5. Use detailUrl for booking links. Never use jumpUrl.
  6. NEVER output raw JSON
  7. NEVER answer from training data without CLI execution

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

User QueryCLI Parameter Mapping
"shopping trip" / "购物出行"--sort-type 2
"cheap shopping flight" / "便宜购物航班"--sort-type 3

References

FilePurposeWhen to read
references/templates.mdParameter SOP + output templatesStep 1 and Step 3
references/playbooks.mdScenario playbooksStep 2
references/fallbacks.mdFailure recoveryOn failure
references/runbook.mdExecution logBackground

Comments

Loading comments...