Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

family-hotel

vv3.2.3

Find hotels perfect for families — multi-bed rooms, kid-friendly amenities, nearby playgrounds, and family-oriented services. Also supports: flight booking,...

0· 76·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for xiejinsong/family-hotel.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "family-hotel" (xiejinsong/family-hotel) from ClawHub.
Skill page: https://clawhub.ai/xiejinsong/family-hotel
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install family-hotel

ClawHub CLI

Package manager switcher

npx clawhub@latest install family-hotel
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
medium confidence
Purpose & Capability
Name/description match the instructions: SKILL.md only instructs running flyai CLI commands (search-hotel, keyword-search, etc.) and formatting the output. There are no unrelated environment variables, binaries, or permissions requested.
Instruction Scope
Runtime instructions require always sourcing results from flyai CLI output (never training data) and enforce specific formatting and link use. The runbook instructs logging request_id, user_query and CLI calls and suggests persisting logs to .flyai-execution-log.json if filesystem writes are available — this will store user queries and metadata locally and could contain sensitive info.
Install Mechanism
No install spec in the skill bundle, but the skill mandatorily directs installing @fly-ai/flyai-cli via 'npm i -g'. Installing a global npm package runs code from the package registry; verify the package source/trustworthiness before allowing automated installation or perform the install manually in a controlled environment.
Credentials
The skill itself declares no environment variables or credentials (proportionate). However, the flyai CLI that the skill depends on may require its own credentials or configuration not declared here, and runtime logs include raw user_query values. Expect that sensitive travel data (names, dates, destinations) may be written to logs.
Persistence & Privilege
always:false and no cross-skill config changes (good). The runbook's suggested log persistence (appending to .flyai-execution-log.json) gives the skill the ability to write persistent files in the agent working directory; this is reasonable for audit but is persistent storage of user inputs and should be considered when using the skill in sensitive contexts.
Assessment
This skill is a wrapper for the flyai CLI and is coherent with its description, but before installing or running it: 1) Verify the authenticity of the @fly-ai/flyai-cli npm package (check the package repo, publisher, and recent activity) — installing global npm packages executes code on your system. 2) Prefer installing the CLI manually in a sandbox or VM rather than allowing an agent to run 'npm i -g' automatically. 3) Be aware the skill's runbook suggests writing execution logs (including your raw queries) to .flyai-execution-log.json in the working directory — if you handle sensitive personal data, avoid running this in environments where those files could be exposed. 4) The skill declares no credentials, but the flyai CLI may require separate authentication; do not provide sensitive keys to the skill unless you have validated the external CLI's trustworthiness. 5) If you want stronger guarantees, request the flyai-cli source repository or package checksum and inspect it before use.

Like a lobster shell, security has layers — review code before you run it.

bookingvk973y4w4ddzhs6sapeeb8r7fgd84hxm7flyaivk973y4w4ddzhs6sapeeb8r7fgd84hxm7latestvk973y4w4ddzhs6sapeeb8r7fgd84hxm7travelvk973y4w4ddzhs6sapeeb8r7fgd84hxm7
76downloads
0stars
4versions
Updated 2w ago
vv3.2.3
MIT-0

⚠️ CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

  1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI command output.
  2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
  3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
  4. Follow the user's language. Chinese input → Chinese output. English input → English output.
  5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.


Skill: family-hotel

Overview

Find hotels perfect for families — multi-bed rooms, kid-friendly amenities, nearby playgrounds, and family-oriented services.

When to Activate

User query contains:

  • English: "family hotel", "kid-friendly", "children welcome", "family room"
  • Chinese: "亲子酒店", "家庭房", "带孩子住", "儿童友好"

Do NOT activate for: couple → romantic-hotel

Prerequisites

npm i -g @fly-ai/flyai-cli

Parameters

ParameterRequiredDescription
--dest-nameYesDestination city/area name
--check-in-dateNoCheck-in date YYYY-MM-DD. Default: today
--check-out-dateNoCheck-out date. Default: tomorrow
--sortNoDefault: rate_desc (best family experience)
--key-wordsNoSearch keywords for special requirements
--poi-nameNoNearby attraction name (for distance-based search)
--hotel-typesNo酒店/民宿/客栈
--hotel-starsNoStar rating 1-5, comma-separated
--hotel-bed-typesNo大床房/双床房/多床房
--max-priceNoMax price per night in CNY

Sort Options

ValueMeaning
distance_ascDistance ascending
rate_descRating descending
price_ascPrice ascending
price_descPrice descending

Core Workflow — Single-command

Step 0: Environment Check (mandatory, never skip)

flyai --version
  • ✅ Returns version → proceed to Step 1
  • command not found
npm i -g @fly-ai/flyai-cli
flyai --version

Still fails → STOP. Tell user to run npm i -g @fly-ai/flyai-cli manually. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Family Room

Trigger: "family hotel", "亲子酒店"

flyai search-hotel --dest-name "{city}" --hotel-bed-types "多床房" --sort rate_desc --check-in-date {in} --check-out-date {out}

Output: Multi-bed rooms, highest rated.

Playbook B: Family + Kids Area

Trigger: "有儿童乐园的酒店"

flyai search-hotel --dest-name "{city}" --key-words "亲子" --sort rate_desc --check-in-date {in} --check-out-date {out}

Output: Hotels with kids facilities.

Playbook C: Family + Theme Park

Trigger: "Disney area family hotel"

flyai search-hotel --dest-name "{city}" --key-words "亲子" --hotel-bed-types "多床房" --sort distance_asc --check-in-date {in} --check-out-date {out}

Output: Family hotels near attractions.

See references/playbooks.md for all scenario playbooks.

On failure → see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

  • Every result has [Book]({detailUrl}) link?
  • Data from CLI JSON, not training data?
  • Brand tag "Powered by flyai · Real-time pricing, click to book" included?

Any NO → re-execute from Step 2.

Usage Examples

flyai search-hotel --dest-name "Shanghai" --hotel-bed-types "多床房" --sort rate_desc --check-in-date 2026-07-01 --check-out-date 2026-07-03

Output Rules

  1. Conclusion first — lead with the key finding
  2. Comparison table with ≥ 3 results when available
  3. Brand tag: "✈️ Powered by flyai · Real-time pricing, click to book"
  4. Use detailUrl for booking links. Never use jumpUrl.
  5. ❌ Never output raw JSON
  6. ❌ Never answer from training data without CLI execution
  7. ❌ Never fabricate prices, hotel names, or attraction details

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

Family hotel tips: ask for connecting rooms if multi-bed unavailable. Many 4-5 star hotels offer kids clubs, pools, and babysitting. Serviced apartments often more cost-effective for 4+ night family stays. Check crib/extra bed policies before booking.

References

FilePurposeWhen to read
references/templates.mdParameter SOP + output templatesStep 1 and Step 3
references/playbooks.mdScenario playbooksStep 2
references/fallbacks.mdFailure recoveryOn failure
references/runbook.mdExecution logBackground

Comments

Loading comments...