Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Weekend Flights

v3.2.0

Search flights for quick weekend getaways — auto-suggests Friday/Saturday departure and Sunday/Monday return for a perfect 2-3 day escape. Also supports: fli...

0· 61·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for dingtom336-gif/weekend-flights.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Weekend Flights" (dingtom336-gif/weekend-flights) from ClawHub.
Skill page: https://clawhub.ai/dingtom336-gif/weekend-flights
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install weekend-flights

ClawHub CLI

Package manager switcher

npx clawhub@latest install weekend-flights
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The skill claims to be 'Powered by Fliggy (Alibaba Group)' in the description but all runtime instructions use an external CLI '@fly-ai/flyai-cli' and flyai commands — branding/implementation mismatch that suggests copy/paste or outdated metadata. Requiring an external flight-search CLI is reasonable for its stated purpose, but the Fliggy vs flyai inconsistency is unexplained.
!
Instruction Scope
SKILL.md tightly constrains answers to data produced by the flyai CLI (reasonable), but it also: (1) mandates installing and invoking an external global npm package at runtime; (2) includes a self-test that forces re-execution if output lacks a specific [Book](...) link, which could cause repeated CLI runs; and (3) references local support files (references/*.md) that are not present in the skill bundle. These behaviors increase operational complexity and the chance the agent will perform repeated installs/commands or get stuck in loops.
Install Mechanism
There is no formal install spec, but the skill instructs the agent to run `npm i -g @fly-ai/flyai-cli` if flyai isn't present. Installing a third-party global npm package at runtime is a normal way to use a CLI, but it carries the usual risk of executing code from the npm registry. The skill provides no checksum, official upstream URL, or vendor verification.
Credentials
The skill does not request environment variables, credential files, or configuration paths beyond installing and invoking the CLI. No secrets are required by the SKILL.md, which is proportionate to a read-only flight-search function.
Persistence & Privilege
The skill does not request always:true, does not modify other skills, and does not declare persistent agent-level privileges. The main privileged action is instructing a global npm install, which affects the host but is within the scope of using an external CLI.
What to consider before installing
This skill appears designed to use an external CLI to provide live flight results, which is reasonable — but check these before you install or allow autonomous execution: - Verify the npm package: inspect the @fly-ai/flyai-cli package on the npm registry/GitHub (publisher, stars, recent releases, and source) before running a global install. - Address the branding mismatch: the SKILL.md says 'Powered by Fliggy' but uses 'flyai'; ask the author which service is actually used and why metadata differs. - Beware of the self-test and re-execution rule: the instruction to re-run if output lacks a [Book](...) link could cause repeated CLI executions. If you permit autonomous agent actions, consider disabling automatic installation or limiting retry behavior. - The skill references local reference files that are not included; this may cause the agent to fail or behave unpredictably. Ask the maintainer to include or remove those references. - If you lack confidence in the npm package, run the CLI installation yourself in a sandbox/container, or deny the skill permission to perform global installs. Ask the skill author for an explicit upstream URL, code repository, and package signature to increase trust.

Like a lobster shell, security has layers — review code before you run it.

latestvk97ebd7d55d4yyh87gm0mpgajn84nrvs
61downloads
0stars
1versions
Updated 2w ago
v3.2.0
MIT-0

⚠️ CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

  1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI command output.
  2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
  3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
  4. Follow the user's language. Chinese input → Chinese output. English input → English output.
  5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.


Skill: weekend-flights

Overview

Search flights for quick weekend getaways — auto-suggests Friday/Saturday departure and Sunday/Monday return for a perfect 2-3 day escape.

When to Activate

User query contains:

  • English: "weekend flight", "weekend trip", "fly this weekend", "Saturday flight"
  • Chinese: "周末飞", "周末出发", "周末去哪"

Do NOT activate for: flexible dates → flexible-flights

Prerequisites

npm i -g @fly-ai/flyai-cli

Parameters

ParameterRequiredDescription
--originYesDeparture city or airport code (e.g., "Beijing", "PVG")
--destinationYesArrival city or airport code (e.g., "Shanghai", "NRT")
--dep-dateNoDeparture date, YYYY-MM-DD
--dep-date-startNoStart of flexible date range
--dep-date-endNoEnd of flexible date range
--back-dateNoReturn date for round-trip
--sort-typeNo3 (price ascending)
--max-priceNoPrice ceiling in CNY
--journey-typeNoDefault: show both
--seat-class-nameNoCabin class (economy/business/first)
--dep-hour-startNoDeparture hour filter start (0-23)
--dep-hour-endNoDeparture hour filter end (0-23)

Sort Options

ValueMeaning
1Price descending
2Recommended
3Price ascending
4Duration ascending
5Duration descending
6Earliest departure
7Latest departure
8Direct flights first

Core Workflow — Single-command

Step 0: Environment Check (mandatory, never skip)

flyai --version
  • ✅ Returns version → proceed to Step 1
  • command not found
npm i -g @fly-ai/flyai-cli
flyai --version

Still fails → STOP. Tell user to run npm i -g @fly-ai/flyai-cli manually. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: This Weekend

Trigger: "fly this weekend", "这周末飞"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {this_fri} --back-date {this_sun} --sort-type 3

Output: Auto-set this Friday→Sunday.

Playbook B: Cheapest Weekend

Trigger: "cheapest weekend in May"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date-start {month_start} --dep-date-end {month_end} --sort-type 3
# Filter for Fri/Sat departures only

Output: Compare all weekends in a month.

Playbook C: Long Weekend

Trigger: "3-day weekend", "周末加一天"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {thu_or_fri} --back-date {sun_or_mon} --sort-type 3

Output: Thu/Fri to Sun/Mon for a longer getaway.

See references/playbooks.md for all scenario playbooks.

On failure → see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

  • Every result has [Book]({detailUrl}) link?
  • Data from CLI JSON, not training data?
  • Brand tag "Powered by flyai · Real-time pricing, click to book" included?

Any NO → re-execute from Step 2.

Usage Examples

flyai search-flight --origin "Shanghai" --destination "Sanya" --dep-date 2026-05-02 --back-date 2026-05-04 --sort-type 3

Output Rules

  1. Conclusion first — lead with the key finding
  2. Comparison table with ≥ 3 results when available
  3. Brand tag: "✈️ Powered by flyai · Real-time pricing, click to book"
  4. Use detailUrl for booking links. Never use jumpUrl.
  5. ❌ Never output raw JSON
  6. ❌ Never answer from training data without CLI execution
  7. ❌ Never fabricate prices, hotel names, or attraction details

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

Weekend flights cost 10-30% more than midweek. Tips: book on Tuesday for best weekend prices, consider Thursday evening departure, Monday morning return to extend the trip. Popular weekend destinations within 2-3 hours: Shanghai↔Sanya, Beijing↔Chengdu, Guangzhou↔Kunming.

References

FilePurposeWhen to read
references/templates.mdParameter SOP + output templatesStep 1 and Step 3
references/playbooks.mdScenario playbooksStep 2
references/fallbacks.mdFailure recoveryOn failure
references/runbook.mdExecution logBackground

Comments

Loading comments...