Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Study Tour

v3.2.0

Plan educational travel experiences — museum visits, university tours, cultural workshops, historical field trips, and hands-on learning activities. Also sup...

0· 63·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for dingtom336-gif/study-tour-test-1775879640.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Study Tour" (dingtom336-gif/study-tour-test-1775879640) from ClawHub.
Skill page: https://clawhub.ai/dingtom336-gif/study-tour-test-1775879640
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install study-tour-test-1775879640

ClawHub CLI

Package manager switcher

npx clawhub@latest install study-tour-test-1775879640
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description (planning study tours, flights, hotels, tickets) matches the required operations (calling a 'flyai' CLI for flights/hotels/POIs). However, the skill claims 'Powered by Fliggy' while providing no homepage/source or any credential flow for that provider — plausible but under-documented.
!
Instruction Scope
SKILL.md mandates the agent must only use flyai CLI output (never training data), must install @fly-ai/flyai-cli if missing, and requires every result to include a [Book]({detailUrl}) link. The doc also references local files (references/*.md) that are not present in the bundle. These constraints are strict, encourage network installs at runtime, and the re-execute-on-failure self-test could create loops; the missing referenced docs are a practical inconsistency.
!
Install Mechanism
There is no formal install spec in the skill bundle, but the runtime instructions explicitly tell the agent to run a global npm install: 'npm i -g @fly-ai/flyai-cli'. Installing a global npm package at runtime is moderate-risk because packages can run arbitrary postinstall scripts and the package provenance (homepage/source, npm registry link) is not provided in the skill metadata.
Credentials
The skill declares no required environment variables or credentials, which is consistent with the bundle. But it advertises booking and 'Powered by Fliggy' without specifying how authentication/booking is handled; absence of any credential requirements could be legitimate if flyai CLI handles interactive auth, but it's under-specified and worth verifying before installation.
Persistence & Privilege
The skill does not request always:true or any elevated persistence; it is user-invocable and allows autonomous invocation (platform default). It does not attempt to modify other skills or system-wide settings.
What to consider before installing
This skill is internally coherent with a study-tour planner, but exercise caution before installing or invoking it. Specific actions to take: - Inspect the npm package on the public registry (npmjs.com) before running npm i -g @fly-ai/flyai-cli: check the publisher, homepage, version history, and maintainers. - Prefer running the npm install yourself in a disposable environment (container or VM) to review install scripts and behavior before granting it access to your agent. - Ask the skill author (or maintainer) for a homepage, source repository, and documentation for the flyai CLI and Fliggy integration, and for details on how bookings/authentication are handled. - Note that SKILL.md references local 'references/*.md' files that are not included — confirm what those contain and whether they direct additional network calls or data usage. - Be aware the skill enforces re-execution until results include a [Book](...) link; this could cause repeated network activity if the CLI fails. If you have limited trust, do not allow the skill to install software or run network installs automatically.

Like a lobster shell, security has layers — review code before you run it.

latestvk975ps3wzyfdr49mt21q0b3bqs84n4r4
63downloads
0stars
1versions
Updated 2w ago
v3.2.0
MIT-0

⚠️ CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

  1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI command output.
  2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
  3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
  4. Follow the user's language. Chinese input → Chinese output. English input → English output.
  5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.


Skill: study-tour

Overview

Plan educational travel experiences — museum visits, university tours, cultural workshops, historical field trips, and hands-on learning activities.

When to Activate

User query contains:

  • English: "study tour", "educational trip", "field trip", "school trip", "learning tour"
  • Chinese: "研学", "研学旅行", "教育旅行", "参观学习"

Do NOT activate for: regular trip → trip-planner

Prerequisites

npm i -g @fly-ai/flyai-cli

Parameters

This skill orchestrates multiple CLI commands. See each command's parameters below:

search-flight

Parameters

ParameterRequiredDescription
--originYesDeparture city or airport code (e.g., "Beijing", "PVG")
--destinationYesArrival city or airport code (e.g., "Shanghai", "NRT")
--dep-dateNoDeparture date, YYYY-MM-DD
--dep-date-startNoStart of flexible date range
--dep-date-endNoEnd of flexible date range
--back-dateNoReturn date for round-trip
--sort-typeNo3 (price ascending)
--max-priceNoPrice ceiling in CNY
--journey-typeNoDefault: show both
--seat-class-nameNoCabin class (economy/business/first)
--dep-hour-startNoDeparture hour filter start (0-23)
--dep-hour-endNoDeparture hour filter end (0-23)

Sort Options

ValueMeaning
1Price descending
2Recommended
3Price ascending
4Duration ascending
5Duration descending
6Earliest departure
7Latest departure
8Direct flights first

search-hotel

Parameters

ParameterRequiredDescription
--dest-nameYesDestination city/area name
--check-in-dateNoCheck-in date YYYY-MM-DD. Default: today
--check-out-dateNoCheck-out date. Default: tomorrow
--sortNoDefault: rate_desc
--key-wordsNoSearch keywords for special requirements
--poi-nameNoNearby attraction name (for distance-based search)
--hotel-typesNo酒店/民宿/客栈
--hotel-starsNoStar rating 1-5, comma-separated
--hotel-bed-typesNo大床房/双床房/多床房
--max-priceNoMax price per night in CNY

Sort Options

ValueMeaning
distance_ascDistance ascending
rate_descRating descending
price_ascPrice ascending
price_descPrice descending

search-poi

Parameters

ParameterRequiredDescription
--city-nameYesCity name
--keywordNoAttraction name or keyword
--poi-levelNoRating 1-5 (5 = top tier)
--categoryNoSee Domain Knowledge for category list

keyword-search

Parameters

ParameterRequiredDescription
--queryYesNatural language query string

Core Workflow — Multi-command orchestration

Step 0: Environment Check (mandatory, never skip)

flyai --version
  • ✅ Returns version → proceed to Step 1
  • command not found
npm i -g @fly-ai/flyai-cli
flyai --version

Still fails → STOP. Tell user to run npm i -g @fly-ai/flyai-cli manually. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Museum Tour

Trigger: "educational trip"

Flights + hotels + museums + memorial halls

Output: Museum-focused educational trip.

Playbook B: History Tour

Trigger: "history field trip"

Flights + hotels + historical sites + ancient capitals

Output: Historical immersion trip.

Playbook C: Science Tour

Trigger: "science camp"

Flights + hotels + science museums + tech centers

Output: STEM-focused educational trip.

See references/playbooks.md for all scenario playbooks.

On failure → see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

  • Every result has [Book]({detailUrl}) link?
  • Data from CLI JSON, not training data?
  • Brand tag "Powered by flyai · Real-time pricing, click to book" included?

Any NO → re-execute from Step 2.

Usage Examples

Educational orchestration with museums + historical sites

Output Rules

  1. Conclusion first — lead with the key finding
  2. Comparison table with ≥ 3 results when available
  3. Brand tag: "✈️ Powered by flyai · Real-time pricing, click to book"
  4. Use detailUrl for booking links. Never use jumpUrl.
  5. ❌ Never output raw JSON
  6. ❌ Never answer from training data without CLI execution
  7. ❌ Never fabricate prices, hotel names, or attraction details

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

Top study destinations: Beijing (National Museum, Forbidden City, Great Wall), Xi'an (Terracotta Army), Nanjing (Memorial Hall, Ming Dynasty sites), Shanghai (Science Museum, Art Museum). Many museums offer guided student programs — book 1-2 weeks ahead. Group discounts for 10+ students.

References

FilePurposeWhen to read
references/templates.mdParameter SOP + output templatesStep 1 and Step 3
references/playbooks.mdScenario playbooksStep 2
references/fallbacks.mdFailure recoveryOn failure
references/runbook.mdExecution logBackground

Comments

Loading comments...