Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

smart-hotel-search

v1.0.0

基于小红书真实测评挖掘非标准酒店需求,结合飞猪实时预订信息,提供个性化场景化酒店推荐。

0· 83·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for sgw153759-oss/smart-hotel-search.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "smart-hotel-search" (sgw153759-oss/smart-hotel-search) from ClawHub.
Skill page: https://clawhub.ai/sgw153759-oss/smart-hotel-search
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install smart-hotel-search

ClawHub CLI

Package manager switcher

npx clawhub@latest install smart-hotel-search
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
medium confidence
Purpose & Capability
The skill claims to mine Xiaohongshu content and query Flyai for booking info; the SKILL.md exclusively instructs using opencli (to read Xiaohongshu via the user's Chrome session) and flyai (to query booking data). There are no unrelated environment variables, binaries, or config paths requested, so the requested capabilities align with the stated purpose.
Instruction Scope
Instructions explicitly require running opencli xiaohongshu search and flyai search-hotel and to have Chrome logged into Xiaohongshu. That scope matches the purpose, but opencli works by connecting to a browser extension and the user's logged-in browser session — this grants the tooling access to browser state/cookies. The skill's instructions do not ask to read other local files or unrelated credentials, but the reliance on a browser extension is a privacy/security consideration.
Install Mechanism
The skill is instruction-only (no install spec embedded). It references installing two npm CLIs and a Chrome extension from a GitHub releases page. Installing npm packages globally and a browser extension is a common approach here, but installing an extension from releases and running opencli setup involves giving the tool local browser access — verify the extension release authenticity and the npm packages' provenance before installing.
Credentials
The skill declares no required environment variables; the installation docs mention an optional FLYAI_API_KEY to improve Flyai results, which is proportionate. There are no unrelated credentials requested. Note: opencli's setup may create local tokens or require connecting to an extension/daemon (not declared as env vars), so check what local files/config are written during setup.
Persistence & Privilege
The skill does not request always:true and makes no claims about modifying other skills or system-wide settings. Autonomous invocation is allowed (platform default) but not combined with excessive privileges in this package.
Assessment
This skill appears to do what it says: it searches Xiaohongshu for user reviews (via opencli) and then looks up booking details on Flyai. Before installing or following the install steps, do the following: 1) Verify the provenance of opencli and the Chrome extension (confirm GitHub repo and release integrity). 2) Be aware that opencli's extension/daemon uses your local Chrome login — avoid using it with a browser profile that has sensitive accounts, or use a separate profile. 3) Verify the npm packages (@jackwener/opencli and @fly-ai/flyai-cli) on npm and check recent maintainer activity and reviews. 4) Treat any request to set a FLYAI_API_KEY as you would any API key (use least-privilege key, rotate if needed). 5) Because the skill source/homepage is unknown, consider testing in an isolated environment (separate browser profile or VM) first. If you can't verify the third-party tools' legitimacy, don't install the extension or run opencli setup with your primary browser.

Like a lobster shell, security has layers — review code before you run it.

latestvk978fnx6br0t04nrgpe7xmj7xd841t1m
83downloads
0stars
1versions
Updated 3w ago
v1.0.0
MIT-0

Smart Hotel Search

用"内容平台理解需求 + 交易平台对接供给"的组合,承接任意非标准酒店搜索诉求。

Prerequisites

必须先检查并安装所需工具,确保闭环可用。

快速检查

# 检查工具是否已安装
which opencli && echo "✅ opencli 已安装" || echo "❌ opencli 未安装"
which flyai && echo "✅ flyai 已安装" || echo "❌ flyai 未安装"

如果两个工具都已安装,跳过安装步骤,直接进入 Workflow。

安装指南

如果任一工具未安装,详见 references/installation.md 获取完整安装步骤:

  • flyai: npm i -g @fly-ai/flyai-cli
  • opencli: Chrome + Playwright MCP Bridge插件 + 登录小红书

环境就绪确认

继续前,确认以下条件满足:

  • opencli 命令可用
  • flyai 命令可用
  • ✅ Chrome 已登录小红书

如果任一条件不满足,先阅读 installation.md 完成安装再继续。

Workflow

触发条件: 用户需求是自然语言、非结构化的,标准搜索接口无法承接。

用户需求(自然语言)
    ↓
语义理解层 - opencli xiaohongshu search
    ↓
内容发现 → AI 提取酒店名
    ↓
供给对接层 - flyai search-hotel
    ↓
输出:测评 + 价格 + 链接

Step 1: 内容发现

使用 opencli xiaohongshu search 在小红书搜索用户真实测评:

opencli xiaohongshu search "三亚带狗住酒店推荐"
opencli xiaohongshu search "无边泳池酒店 网红打卡"
opencli xiaohongshu search "适合带老人的酒店 安静"

从搜索结果中提取:

  • 酒店名称
  • 用户真实评价(环境、设施、服务)
  • 实际体验(图片、视频)

Step 2: AI提取酒店名

从小红书搜索结果中识别候选酒店:

  • 提取酒店名称(注意区分民宿、公寓、酒店)
  • 收集用户评价关键词
  • 过滤广告内容、推广贴

Step 3: 飞猪搜索

对每个候选酒店,使用 flyai search-hotel 获取可预订信息:

flyai search-hotel --key-words "三亚某度假酒店" --check-in "2024-01-15" --check-out "2024-01-17"

获取:

  • 实时价格
  • 房型信息
  • 预订链接
  • 用户评分

Step 4: 综合输出

返回给用户:

  1. 小红书真实测评(1-2条精华内容)
  2. 飞猪预订信息(价格、链接)
  3. 综合推荐结论(为什么推荐)

失败处理

情况处理方式
小红书搜不到相关内容扩大搜索范围,或提示"暂无相关内容,建议换个说法试试"
提取的酒店名在飞猪搜不到提示"该酒店可能不在飞猪,建议联系酒店直接预订"
内容平台评价不客观标注来源,提示"信息来自用户分享,建议入住前与酒店确认"
用户需求太模糊引导用户补充关键信息(目的地、时间、预算等)

Examples

详见 references/examples.md 获取完整输入输出示例。

Tips

  • 语义理解优先:先理解用户真实需求,再选择合适的关键词搜索小红书
  • 多角度搜索:一个需求可能需要多次搜索(如"宠物友好"可搜"带狗住"、"宠物入住"、"狗狗友好")
  • 信息交叉验证:小红书评价 + 飞猪评分 = 更可靠的推荐
  • 标注来源:让用户知道信息来自真实用户分享,而非官方宣传

Comments

Loading comments...