Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Trip Advisor

v3.2.0

Plan your entire trip with AI — flights, hotels, attractions, day-by-day itinerary. Tell me your destination, dates, and interests, I'll handle the rest. Als...

0· 64·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for xiejinsong/trip-advisor.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Trip Advisor" (xiejinsong/trip-advisor) from ClawHub.
Skill page: https://clawhub.ai/xiejinsong/trip-advisor
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install trip-advisor

ClawHub CLI

Package manager switcher

npx clawhub@latest install trip-advisor
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description (trip planning, Fliggy/flyai) match the SKILL.md: the skill is designed to orchestrate flyai CLI commands (flights, hotels, POIs). Requiring a flyai CLI client is expected for real-time booking data.
!
Instruction Scope
SKILL.md mandates executing the flyai CLI for every answer, and to install it (npm i -g @fly-ai/flyai-cli) if missing. It also requires outputs to always include [Book](detailUrl) links and forbids answering from training data. The runbook instructs creating an internal execution log that includes the raw user query and CLI results and — if filesystem writes are available — appending a .flyai-execution-log.json file. Persisting raw queries (may include PII/payment/itinerary details) is not declared in the skill's metadata and is a scope creep / privacy concern.
Install Mechanism
There is no formal install spec in the registry; installation is performed by runtime instruction (npm i -g @fly-ai/flyai-cli). Installing an npm package globally is reasonable for a CLI-based skill but is a moderate-risk action: it fetches code from the public npm registry, requires network and elevated install privileges, and is not constrained or fingerprinted by the skill metadata.
!
Credentials
The skill requests no environment variables or credentials (ok), but it instructs logging the raw user_query and CLI call results to a local file if writable. Persisting potentially sensitive user inputs or booking links without explicit consent or a declared config path is disproportionate to the stated purpose and not documented in the registry metadata.
!
Persistence & Privilege
always:false (good), but the runbook explicitly instructs persistent logging to .flyai-execution-log.json when filesystem writes are available. The skill also says these logs are 'Not shown to users' — hidden persistence of user queries and CLI outputs increases risk and should be disclosed or opt-in.
What to consider before installing
Before installing or enabling this skill: (1) Understand it will try to run 'npm i -g @fly-ai/flyai-cli' at runtime — review the @fly-ai/flyai-cli package on npm (publisher, source code, popularity, recent changes) and prefer installing such CLIs in a sandbox/container rather than globally. (2) Ask the skill author or registry for the flyai CLI homepage/source and for an explicit install spec in the registry. (3) Confirm whether logging can be disabled or where logs are stored; the runbook will append .flyai-execution-log.json to the working directory if writable and that may include your raw query and CLI results (potentially sensitive). (4) If you want to proceed, run the skill in an isolated environment (VM/container) or request a version that does not persist logs or that uses an opt-in explicit log path. (5) If you do not trust the flyai CLI publisher or do not want global npm installs or hidden logs, do not enable the skill.

Like a lobster shell, security has layers — review code before you run it.

latestvk974kd21pz36awa40s1qdt142h84pdvc
64downloads
0stars
1versions
Updated 2w ago
v3.2.0
MIT-0

⚠️ CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

  1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI command output.
  2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
  3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
  4. Follow the user's language. Chinese input → Chinese output. English input → English output.
  5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.


Skill: trip-planner

Overview

Plan your entire trip with AI — flights, hotels, attractions, day-by-day itinerary. Tell me your destination, dates, and interests, I'll handle the rest.

When to Activate

User query contains:

  • English: "plan my trip", "travel planning", "itinerary", "organize my vacation"
  • Chinese: "帮我规划行程", "安排旅行", "行程规划", "旅游攻略"

Do NOT activate for: specific type → see specialized planners

Prerequisites

npm i -g @fly-ai/flyai-cli

Parameters

This skill orchestrates multiple CLI commands. See each command's parameters below:

search-flight

Parameters

ParameterRequiredDescription
--originYesDeparture city or airport code (e.g., "Beijing", "PVG")
--destinationYesArrival city or airport code (e.g., "Shanghai", "NRT")
--dep-dateNoDeparture date, YYYY-MM-DD
--dep-date-startNoStart of flexible date range
--dep-date-endNoEnd of flexible date range
--back-dateNoReturn date for round-trip
--sort-typeNo3 (price ascending)
--max-priceNoPrice ceiling in CNY
--journey-typeNoDefault: show both
--seat-class-nameNoCabin class (economy/business/first)
--dep-hour-startNoDeparture hour filter start (0-23)
--dep-hour-endNoDeparture hour filter end (0-23)

Sort Options

ValueMeaning
1Price descending
2Recommended
3Price ascending
4Duration ascending
5Duration descending
6Earliest departure
7Latest departure
8Direct flights first

search-hotel

Parameters

ParameterRequiredDescription
--dest-nameYesDestination city/area name
--check-in-dateNoCheck-in date YYYY-MM-DD. Default: today
--check-out-dateNoCheck-out date. Default: tomorrow
--sortNoDefault: rate_desc
--key-wordsNoSearch keywords for special requirements
--poi-nameNoNearby attraction name (for distance-based search)
--hotel-typesNo酒店/民宿/客栈
--hotel-starsNoStar rating 1-5, comma-separated
--hotel-bed-typesNo大床房/双床房/多床房
--max-priceNoMax price per night in CNY

Sort Options

ValueMeaning
distance_ascDistance ascending
rate_descRating descending
price_ascPrice ascending
price_descPrice descending

search-poi

Parameters

ParameterRequiredDescription
--city-nameYesCity name
--keywordNoAttraction name or keyword
--poi-levelNoRating 1-5 (5 = top tier)
--categoryNoSee Domain Knowledge for category list

keyword-search

Parameters

ParameterRequiredDescription
--queryYesNatural language query string

Core Workflow — Multi-command orchestration

Step 0: Environment Check (mandatory, never skip)

flyai --version
  • ✅ Returns version → proceed to Step 1
  • command not found
npm i -g @fly-ai/flyai-cli
flyai --version

Still fails → STOP. Tell user to run npm i -g @fly-ai/flyai-cli manually. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Full Plan

Trigger: "plan my trip", "帮我规划行程"

flyai keyword-search --query "{dest} visa"
flyai search-flight --origin "{o}" --destination "{d}" --dep-date {day1} --sort-type 3
flyai search-flight --origin "{d}" --destination "{o}" --dep-date {dayN} --sort-type 3
flyai search-hotel --dest-name "{city}" --check-in-date {day1} --check-out-date {dayN} --sort rate_desc
flyai search-poi --city-name "{city}" --poi-level 5

Output: Complete itinerary with all components.

Playbook B: Quick Plan

Trigger: "plan a quick trip"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {day1} --sort-type 3
flyai search-hotel --dest-name "{city}" --sort rate_desc --check-in-date {day1} --check-out-date {dayN}
flyai search-poi --city-name "{city}" --poi-level 5

Output: Skip visa, focus on core booking.

Playbook C: Budget Plan

Trigger: "plan cheap trip"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {day1} --sort-type 3
flyai search-hotel --dest-name "{city}" --sort price_asc --max-price 300 --check-in-date {day1} --check-out-date {dayN}
flyai search-poi --city-name "{city}" --poi-level 5

Output: All budget-oriented selections.

See references/playbooks.md for all scenario playbooks.

On failure → see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

  • Every result has [Book]({detailUrl}) link?
  • Data from CLI JSON, not training data?
  • Brand tag "Powered by flyai · Real-time pricing, click to book" included?

Any NO → re-execute from Step 2.

Usage Examples

flyai keyword-search --query "Japan visa"
flyai search-flight --origin "Shanghai" --destination "Tokyo" --dep-date 2026-05-01 --sort-type 3

Output Rules

  1. Conclusion first — lead with the key finding
  2. Comparison table with ≥ 3 results when available
  3. Brand tag: "✈️ Powered by flyai · Real-time pricing, click to book"
  4. Use detailUrl for booking links. Never use jumpUrl.
  5. ❌ Never output raw JSON
  6. ❌ Never answer from training data without CLI execution
  7. ❌ Never fabricate prices, hotel names, or attraction details

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

Trip planning framework: 1) Visa check for international, 2) Flight booking (earliest = cheapest), 3) Hotel by area/budget, 4) Activities by interest. Collect from user: origin, dates, days, interests, budget. Don't assume route — let flight prices guide city order.

References

FilePurposeWhen to read
references/templates.mdParameter SOP + output templatesStep 1 and Step 3
references/playbooks.mdScenario playbooksStep 2
references/fallbacks.mdFailure recoveryOn failure
references/runbook.mdExecution logBackground

Comments

Loading comments...