Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Solo Trip

v3.2.0

Plan solo travel adventures — safe destinations, social hostels, solo-friendly activities, and tips for meeting fellow travelers on the road. Also supports:...

0· 63·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for dingtom336-gif/solo-trip.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Solo Trip" (dingtom336-gif/solo-trip) from ClawHub.
Skill page: https://clawhub.ai/dingtom336-gif/solo-trip
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install solo-trip

ClawHub CLI

Package manager switcher

npx clawhub@latest install solo-trip
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill claims to provide real-time travel bookings and names Fliggy (Alibaba Group) as the backend; requiring a CLI (flyai) to get live data is consistent with that purpose. However, the SKILL.md does not declare any credentials or explain how the CLI authenticates to Fliggy (or whether it will prompt for user credentials), which is a missing piece of justification.
!
Instruction Scope
The runtime instructions mandate installing and invoking @fly-ai/flyai-cli and require every answer to come exclusively from that CLI. The runbook also instructs the agent to create an internal execution log and suggests writing it to .flyai-execution-log.json if filesystem writes are available. These steps broaden scope to installing software, accessing network endpoints, and persisting potentially sensitive user queries and command outputs to disk.
!
Install Mechanism
There is no registry install spec, but the SKILL.md explicitly tells the agent to run a global npm install (npm i -g @fly-ai/flyai-cli) at runtime if the CLI is missing. That causes arbitrary code to be fetched and installed from the npm registry during execution — a moderate-to-high risk operation that is not vetted by the skill manifest and is executed without prior user-declared approval in the metadata.
!
Credentials
The skill declares no required environment variables, but the flyai CLI will likely need authentication to book or access live pricing. The SKILL.md does not explain where credentials come from or how they are protected. Additionally, the runbook/logging behavior may capture and persist user queries, commands run, and results — potentially containing PII or booking credentials — without describing retention or access controls.
Persistence & Privilege
The skill is not always-on and does not request special platform privileges. However, it instructs the agent to persist an execution log to disk when possible. Writing .flyai-execution-log.json with raw user_query and CLI outputs increases persistence and local data exposure; this is a notable behavior even if limited to the skill's own logs.
What to consider before installing
This skill is coherent as a CLI-driven travel planner, but it asks the agent to install and run a third-party npm CLI at runtime and to persist execution logs. Before installing or using it: (1) verify the @fly-ai/flyai-cli package and publisher on the npm registry (check package maintainers, versions, and reviews); (2) prefer to install the CLI yourself (not let the agent run npm i -g) so you control installation and can inspect what is installed; (3) confirm how the CLI authenticates to Fliggy and whether any credentials or tokens are required — don't provide secrets unless you trust the CLI and understand where they are stored; (4) ask whether execution logs will be stored locally and what they contain; if you need stronger assurances, decline or sandbox the skill (require explicit approval before any install or filesystem write).

Like a lobster shell, security has layers — review code before you run it.

latestvk970gznfpn2eg4q59zjkg7r85d84mke1
63downloads
0stars
1versions
Updated 2w ago
v3.2.0
MIT-0

⚠️ CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

  1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI command output.
  2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
  3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
  4. Follow the user's language. Chinese input → Chinese output. English input → English output.
  5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.


Skill: solo-trip

Overview

Plan solo travel adventures — safe destinations, social hostels, solo-friendly activities, and tips for meeting fellow travelers on the road.

When to Activate

User query contains:

  • English: "solo travel", "alone trip", "by myself", "single traveler"
  • Chinese: "一个人旅行", "独自旅行", "单独出行"

Do NOT activate for: group → group-tour

Prerequisites

npm i -g @fly-ai/flyai-cli

Parameters

This skill orchestrates multiple CLI commands. See each command's parameters below:

search-flight

Parameters

ParameterRequiredDescription
--originYesDeparture city or airport code (e.g., "Beijing", "PVG")
--destinationYesArrival city or airport code (e.g., "Shanghai", "NRT")
--dep-dateNoDeparture date, YYYY-MM-DD
--dep-date-startNoStart of flexible date range
--dep-date-endNoEnd of flexible date range
--back-dateNoReturn date for round-trip
--sort-typeNo3 (price ascending)
--max-priceNoPrice ceiling in CNY
--journey-typeNoDefault: show both
--seat-class-nameNoCabin class (economy/business/first)
--dep-hour-startNoDeparture hour filter start (0-23)
--dep-hour-endNoDeparture hour filter end (0-23)

Sort Options

ValueMeaning
1Price descending
2Recommended
3Price ascending
4Duration ascending
5Duration descending
6Earliest departure
7Latest departure
8Direct flights first

search-hotel

Parameters

ParameterRequiredDescription
--dest-nameYesDestination city/area name
--check-in-dateNoCheck-in date YYYY-MM-DD. Default: today
--check-out-dateNoCheck-out date. Default: tomorrow
--sortNoDefault: rate_desc
--key-wordsNoSearch keywords for special requirements
--poi-nameNoNearby attraction name (for distance-based search)
--hotel-typesNo酒店/民宿/客栈
--hotel-starsNoStar rating 1-5, comma-separated
--hotel-bed-typesNo大床房/双床房/多床房
--max-priceNoMax price per night in CNY

Sort Options

ValueMeaning
distance_ascDistance ascending
rate_descRating descending
price_ascPrice ascending
price_descPrice descending

search-poi

Parameters

ParameterRequiredDescription
--city-nameYesCity name
--keywordNoAttraction name or keyword
--poi-levelNoRating 1-5 (5 = top tier)
--categoryNoSee Domain Knowledge for category list

keyword-search

Parameters

ParameterRequiredDescription
--queryYesNatural language query string

Core Workflow — Multi-command orchestration

Step 0: Environment Check (mandatory, never skip)

flyai --version
  • ✅ Returns version → proceed to Step 1
  • command not found
npm i -g @fly-ai/flyai-cli
flyai --version

Still fails → STOP. Tell user to run npm i -g @fly-ai/flyai-cli manually. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Solo City

Trigger: "solo travel {city}"

Budget flight + hostel/budget hotel + walking-friendly POIs

Output: Solo city exploration.

Playbook B: Solo Adventure

Trigger: "solo backpacking"

Cheapest flights + hostels + nature/hiking POIs

Output: Adventurous solo trip.

Playbook C: Solo Safe

Trigger: "safe for solo female"

Flights + well-reviewed hotels + popular/safe attractions

Output: Safety-conscious solo travel.

See references/playbooks.md for all scenario playbooks.

On failure → see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

  • Every result has [Book]({detailUrl}) link?
  • Data from CLI JSON, not training data?
  • Brand tag "Powered by flyai · Real-time pricing, click to book" included?

Any NO → re-execute from Step 2.

Usage Examples

Solo orchestration

Output Rules

  1. Conclusion first — lead with the key finding
  2. Comparison table with ≥ 3 results when available
  3. Brand tag: "✈️ Powered by flyai · Real-time pricing, click to book"
  4. Use detailUrl for booking links. Never use jumpUrl.
  5. ❌ Never output raw JSON
  6. ❌ Never answer from training data without CLI execution
  7. ❌ Never fabricate prices, hotel names, or attraction details

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

Solo travel tips: share itinerary with family, choose well-lit accommodations in central areas, hostels great for meeting people, join walking tours or day tours. Safe solo destinations in Asia: Japan (safest), Singapore, Taiwan, Thailand (Chiang Mai). Always have offline maps and local emergency numbers.

References

FilePurposeWhen to read
references/templates.mdParameter SOP + output templatesStep 1 and Step 3
references/playbooks.mdScenario playbooksStep 2
references/fallbacks.mdFailure recoveryOn failure
references/runbook.mdExecution logBackground

Comments

Loading comments...