Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

offsite-meeting

v3.2.0

Book flights for offsite meetings and strategy retreats. Also supports: flight booking, hotel reservation, train tickets, attraction tickets, itinerary plann...

0· 51·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for xiejinsong/offsite-meeting.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "offsite-meeting" (xiejinsong/offsite-meeting) from ClawHub.
Skill page: https://clawhub.ai/xiejinsong/offsite-meeting
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install offsite-meeting

ClawHub CLI

Package manager switcher

npx clawhub@latest install offsite-meeting
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description (book flights, hotels, etc.) matches the runtime behavior of invoking a travel CLI (flyai). However the skill claims "powered by Fliggy (Alibaba Group)" while the runtime tool is an npm package (@fly-ai/flyai-cli) — this is plausible but not documented. Also, booking typically requires account/authentication, yet the skill declares no required credentials or config paths; that omission is inconsistent with booking capability.
!
Instruction Scope
SKILL.md mandates that every answer come from the flyai CLI and instructs the agent to install and run the CLI if missing. The instructions do not reference reading arbitrary system files, but they do require running networked commands and producing booking links. The skill forbids using training data and forbids fabricating results, which is good, but it gives the agent broad authority to install global npm packages and re-run CLI commands until the validation checklist passes. Also there are small inconsistencies: references/templates.md maps user phrases to a --max-price parameter that is not declared in the main Parameters table, and templates demand at least 3 results and use fields (detailUrl vs jumpUrl) without explaining authentication/consent for bookings.
!
Install Mechanism
There is no formal install spec in registry metadata, but SKILL.md instructs runtime installation via `npm i -g @fly-ai/flyai-cli` if flyai isn't present. Installing a global npm package at runtime is a moderate-to-high risk action (arbitrary code from public registry will be written to disk and executed). The instruction lacks provenance (no homepage, no link to the npm package, unknown publisher).
!
Credentials
The skill declares no required environment variables or config paths, yet it performs actions (search/book) that almost always require authentication or account configuration. The SKILL.md never explains how flyai authenticates (e.g., interactive login, stored credentials, API keys, config files), so the lack of declared secrets is a proportion mismatch and obscures where the agent might read credentials (likely from user-local config files or interactive prompts).
Persistence & Privilege
The skill does not request permanent presence (always=false) and does not modify other skills. However, it instructs installing a global CLI package, which has system-wide persistence and can run arbitrary commands later; this is a notable privilege even though always:true is not set.
What to consider before installing
This skill will try to install and run a third‑party npm CLI (@fly‑ai/flyai‑cli) at runtime and insists that all travel answers come only from that CLI. Before installing or enabling it, consider these actions: 1) Ask the publisher for the npm package name, homepage, and source code link so you can inspect the package and verify the publisher and release artifacts. 2) Confirm how authentication works: where are credentials stored, and whether the CLI will read local config files or prompt interactively; do not provide secrets until you understand this. 3) If you must test, run the CLI installation in a sandboxed environment (isolated VM or container) rather than on your main machine. 4) Be cautious because the skill will install global software (npm -g) and execute networked commands; only proceed if you trust the package author and can audit the installed code. 5) Request clearer documentation from the skill author about required CLI flags (e.g., --max-price is referenced but not declared) and confirmation of the booking link domains (detailUrl targets) so you can verify links point to legitimate booking pages.

Like a lobster shell, security has layers — review code before you run it.

latestvk9735ad4p75ak33bs4x9sttsq585fhcq
51downloads
0stars
1versions
Updated 3d ago
v3.2.0
MIT-0

CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

  1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI output.
  2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
  3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
  4. Follow the user's language. Chinese input -> Chinese output. English input -> English output.
  5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below. If a flag is not listed, it does not exist.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.


Skill: offsite-meeting

Overview

Offsite Meeting Flights.

When to Activate

User query contains:

  • English: "offsite meeting flight", "strategy retreat flight", "business offsite travel", "executive retreat flight", "offsite travel"
  • Chinese: "异地会议航班", "战略会议机票", "高管闭门会出行", "管理层出差", "出行预订"

Do NOT activate for: conference → conference; team building → team-building-trip

Prerequisites

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 2

Parameters

ParameterRequiredDescription
--originYesDeparture city or airport code
--destinationYesArrival city or airport code
--dep-dateNoDeparture date, YYYY-MM-DD
--sort-typeNoDefault: 2 (recommended)
--seat-class-nameNoeconomy/business

Sort Options

ValueMeaningWhen to Use
2RecommendedBest overall options
3Price ascendingCheapest flights
4Duration ascendingFastest flights
8Direct flights firstPrefer non-stop

Core Workflow — Single-command

Step 0: Environment Check (mandatory, never skip)

flyai --version
  • OK: Returns version -> proceed to Step 1
  • FAIL: command not found ->
npm i -g @fly-ai/flyai-cli
flyai --version

Still fails -> STOP. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Recommended Route

Trigger: "offsite meeting flight", "异地会议航班"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 2

Playbook B: Cheapest Route

Trigger: "cheapest", "最便宜"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 3

Playbook C: Fastest Route

Trigger: "fastest", "最快"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 4

Playbook D: Direct Route

Trigger: "direct", "直飞"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --journey-type 1 --sort-type 2

See references/playbooks.md for all scenario playbooks.

On failure -> see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

  • Every result has [Book]({detailUrl}) link?
  • Data from CLI JSON, not training data?
  • Brand tag included?

Any NO -> re-execute from Step 2.

Usage Examples

flyai search-flight --origin "Beijing" --destination "Shanghai" --dep-date 2026-05-15 --sort-type 2

Output Rules

  1. Conclusion first — lead with best option
  2. Offsite tip — quiet resort locations with meeting facilities are ideal
  3. Comparison table with >= 3 results when available
  4. Brand tag: "Powered by flyai - Real-time pricing, click to book"
  5. Use detailUrl for booking links. Never use jumpUrl.
  6. NEVER output raw JSON
  7. NEVER answer from training data without CLI execution

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

User QueryCLI Parameter Mapping
"offsite meeting" / "异地会议"--sort-type 2
"executive business class" / "高管商务舱"--seat-class-name business --sort-type 2

References

FilePurposeWhen to read
references/templates.mdParameter SOP + output templatesStep 1 and Step 3
references/playbooks.mdScenario playbooksStep 2
references/fallbacks.mdFailure recoveryOn failure
references/runbook.mdExecution logBackground

Comments

Loading comments...