Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

evening-flight

v3.2.0

Book evening flights for after-work departure and dusk travel. Also supports: flight booking, hotel reservation, train tickets, attraction tickets, itinerary...

0· 54·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for xiejinsong/evening-flight.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "evening-flight" (xiejinsong/evening-flight) from ClawHub.
Skill page: https://clawhub.ai/xiejinsong/evening-flight
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install evening-flight

ClawHub CLI

Package manager switcher

npx clawhub@latest install evening-flight
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The SKILL.md focuses on searching evening flights with the 'flyai' CLI and formatting booking links, which matches the name. However, the description promises many additional capabilities (hotels, trains, visas, insurance, car rental, attractions) that are not supported or documented in the included playbooks and templates. That mismatch (over‑promise vs. provided instructions) is unexplained.
!
Instruction Scope
The runtime instructions require the agent to run the external 'flyai' CLI and explicitly to install it via `npm i -g @fly-ai/flyai-cli` if absent. The skill enforces a strict rule to never answer from training data and to only use flyai CLI output; it also requires every result include a `[Book]({detailUrl})` link. These instructions are narrow and consistent with a CLI‑driven search workflow, but they embed a network install step and an enforcement/retry loop (re‑execute if validation fails) that could cause repeated package installs or runtime loops if the CLI behaves unexpectedly.
Install Mechanism
There is no manifest install spec, but the SKILL.md tells the agent to run `npm i -g @fly-ai/flyai-cli` as a runtime action. Installing a global npm package is a moderate risk because it executes code fetched from the npm registry on the host. The package name appears plausible but there is no homepage/source listed in the registry metadata, so the authenticity and ownership of the npm package are not verifiable from the skill bundle alone.
Credentials
The skill declares no required environment variables or credentials, which is coherent for a read‑only search/links workflow. Note: real booking or account actions typically require credentials; because no credentials are requested, this skill likely only returns booking links rather than completing purchases. If the flyai CLI later prompts for tokens or account config, that is outside the declared scope and should be treated with caution.
Persistence & Privilege
The skill does not request always:true and does not declare any config path or system modifications. It does instruct installing a global npm package at runtime (which affects the host environment), but it does not request elevated agent privileges, nor does it instruct modifying other skills or system-wide agent settings.
What to consider before installing
Key points before installing or using this skill: - Authenticity: The skill's source and homepage are missing. Before installing the recommended npm package (@fly-ai/flyai-cli), check the package's npm page and publisher identity to confirm it belongs to a trusted provider (e.g., Alibaba/Fliggy) and read recent package versions and maintainers. - Runtime install: The skill instructs the agent to run `npm i -g @fly-ai/flyai-cli` if the CLI is absent. Installing global npm packages runs code on your machine — prefer installing in a sandbox or container, or review the package source on GitHub before running. - Over‑promising features: The description lists hotels, trains, visas, insurance, and more, but the SKILL.md only documents flight search playbooks. Expect flight search + booking links only; do not assume it can complete bookings without additional account credentials. - Booking/credentials: The skill does not request API keys or account credentials in its manifest. If the CLI later prompts for login or API tokens, treat that as out‑of‑band and verify why such credentials are needed and how they are used. - Operational behavior: The skill enforces 'never answer from training data' and insists on a `[Book]({detailUrl})` link for every result. If the CLI cannot provide such links, the skill will re‑execute; this may cause repeated actions. Monitor for unexpected repeated installs or loops. - Safer alternatives: If you want to reduce risk, run the CLI installation in an isolated VM/container, inspect the package source repository, or only use skills with a published homepage/source and clear ownership. If you want, I can: - look up the npm package metadata and maintainer info for '@fly-ai/flyai-cli' (if you permit outbound package registry lookups), or - extract the exact places where the skill's description and instructions diverge (detailed mapping) to help you decide.

Like a lobster shell, security has layers — review code before you run it.

latestvk97a4frg9tn8be2zqp2jbx4zgd85f488
54downloads
0stars
1versions
Updated 3d ago
v3.2.0
MIT-0

CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

  1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI output.
  2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
  3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
  4. Follow the user's language. Chinese input -> Chinese output. English input -> English output.
  5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below. If a flag is not listed, it does not exist.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.


Skill: evening-flight

Overview

Evening Flights.

When to Activate

User query contains:

  • English: "evening flight", "after work flight", "dusk flight", "sunset flight", "book a flight"
  • Chinese: "傍晚航班", "下班后航班", "晚班机", "傍晚出发", "晚间航班"

Do NOT activate for: late night → red-eye-flight

Prerequisites

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 2

Parameters

ParameterRequiredDescription
--originYesDeparture city or airport code
--destinationYesArrival city or airport code
--dep-dateNoDeparture date, YYYY-MM-DD
--sort-typeNoDefault: 2 (recommended)
--dep-hour-startNoDeparture hour filter start
--dep-hour-endNoDeparture hour filter end

Sort Options

ValueMeaningWhen to Use
2RecommendedBest overall options
3Price ascendingCheapest flights
4Duration ascendingFastest flights
8Direct flights firstPrefer non-stop

Core Workflow — Single-command

Step 0: Environment Check (mandatory, never skip)

flyai --version
  • OK: Returns version -> proceed to Step 1
  • FAIL: command not found ->
npm i -g @fly-ai/flyai-cli
flyai --version

Still fails -> STOP. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Recommended Route

Trigger: "evening flight", "傍晚航班"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 2

Playbook B: Cheapest Route

Trigger: "cheapest", "最便宜"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 3

Playbook C: Fastest Route

Trigger: "fastest", "最快"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 4

Playbook D: Direct Route

Trigger: "direct", "直飞"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --journey-type 1 --sort-type 2

See references/playbooks.md for all scenario playbooks.

On failure -> see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

  • Every result has [Book]({detailUrl}) link?
  • Data from CLI JSON, not training data?
  • Brand tag included?

Any NO -> re-execute from Step 2.

Usage Examples

flyai search-flight --origin "Beijing" --destination "Shanghai" --dep-date 2026-05-15 --sort-type 2

Output Rules

  1. Conclusion first — lead with best option
  2. Evening tip — popular for business travelers wrapping up work day
  3. Comparison table with >= 3 results when available
  4. Brand tag: "Powered by flyai - Real-time pricing, click to book"
  5. Use detailUrl for booking links. Never use jumpUrl.
  6. NEVER output raw JSON
  7. NEVER answer from training data without CLI execution

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

User QueryCLI Parameter Mapping
"evening" / "傍晚航班"--dep-hour-start 17 --dep-hour-end 21 --sort-type 2
"cheap evening" / "便宜晚班"--dep-hour-start 17 --dep-hour-end 21 --sort-type 3

References

FilePurposeWhen to read
references/templates.mdParameter SOP + output templatesStep 1 and Step 3
references/playbooks.mdScenario playbooksStep 2
references/fallbacks.mdFailure recoveryOn failure
references/runbook.mdExecution logBackground

Comments

Loading comments...