Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Road Trip

v3.2.0

Plan self-driving road trips — optimal routes, car rental, scenic stops along the way, fuel stations, and recommended rest areas. Also supports: flight booki...

0· 66·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for xiejinsong/road-trip.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Road Trip" (xiejinsong/road-trip) from ClawHub.
Skill page: https://clawhub.ai/xiejinsong/road-trip
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install road-trip

ClawHub CLI

Package manager switcher

npx clawhub@latest install road-trip
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill claims to plan road trips and relies on a CLI tool (flyai) to provide real-time booking data, which is a plausible design. However, the description mentions 'Powered by Fliggy (Alibaba Group)' while the runtime tool is '@fly-ai/flyai-cli' — the provenance/branding mismatch is unexplained. Requiring a third-party CLI is a reasonable integration choice only if that tool's trustworthiness is clear; the SKILL.md does not document why flyai is the required provider or how it relates to Fliggy.
!
Instruction Scope
The runtime instructions mandate installing and invoking an external npm package at runtime and require all answers to come from flyai CLI output (never from training data). The skill also references writing an execution log (.flyai-execution-log.json) if filesystem writes are available. Commands and playbooks include some vague or shorthand commands (e.g., 'flyai search-poi along route') that lack explicit parameters, increasing the agent's discretion. Overall the instructions expand the agent's surface to network-facing CLI actions and local filesystem writes beyond simply formatting user-facing routes.
!
Install Mechanism
There is no install spec in the package, but SKILL.md instructs the agent/user to run 'npm i -g @fly-ai/flyai-cli' at runtime. That triggers installation and execution of third-party code from the npm registry without pinned versions, checksums, or an alternative vetted distribution. Runtime instructions to install global npm packages constitute a higher-risk install mechanism (downloads and executes remote code) and are disproportionate for an instruction-only skill unless the CLI's provenance is verified.
!
Credentials
The skill declares no required environment variables or credentials, yet it expects real-time booking and pricing via an external CLI. That implies the CLI may need API keys, user account credentials, or browser-automated sessions at runtime — none of which are declared or scoped here. The absence of declared credential requirements makes it unclear how authentication happens and whether sensitive data (user account tokens, payment info) could be accessed or stored by the CLI.
!
Persistence & Privilege
always is false, and the skill does not request platform-wide privileges, which is good. However, the runbook explicitly instructs appending execution logs to a file ('.flyai-execution-log.json') if filesystem writes are available; those logs include user_query and full CLI command outputs and would persist potentially sensitive information (itineraries, booking links, PII). The skill therefore asks the agent to persist data to disk without clarifying retention, location, or sanitization.
What to consider before installing
This skill asks the agent to install and run a third-party npm CLI (@fly-ai/flyai-cli) at runtime and to write execution logs to disk, while not declaring any credentials or provenance. Before installing or enabling it: (1) Verify the @fly-ai/flyai-cli package (publisher, npm package page, reviews, source repo) and whether it’s trustworthy; (2) Avoid allowing the agent to auto-install packages — install the CLI manually in a sandboxed environment first; (3) Expect the CLI to access the network and possibly prompt for or store credentials — do not expose sensitive API keys or account passwords without confirming where they are stored; (4) Be aware the skill will persist a .flyai-execution-log.json containing queries and CLI outputs; if that is a privacy concern, do not enable file writes or review/clean logs regularly; (5) Consider denying autonomous invocation (require explicit user approval) until you’ve validated the tool. If you cannot verify the CLI's origin and behavior, treat this skill with caution or avoid installing it.

Like a lobster shell, security has layers — review code before you run it.

latestvk976jpw7tzb0de849ygmew3pq584m4w2
66downloads
0stars
1versions
Updated 2w ago
v3.2.0
MIT-0

⚠️ CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

  1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI command output.
  2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
  3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
  4. Follow the user's language. Chinese input → Chinese output. English input → English output.
  5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.


Skill: road-trip

Overview

Plan self-driving road trips — optimal routes, car rental, scenic stops along the way, fuel stations, and recommended rest areas.

When to Activate

User query contains:

  • English: "road trip", "self-drive", "driving trip", "car journey"
  • Chinese: "自驾游", "开车去", "自驾旅行", "公路旅行"

Do NOT activate for: non-driving trip → trip-planner

Prerequisites

npm i -g @fly-ai/flyai-cli

Parameters

This skill orchestrates multiple CLI commands. See each command's parameters below:

search-flight

Parameters

ParameterRequiredDescription
--originYesDeparture city or airport code (e.g., "Beijing", "PVG")
--destinationYesArrival city or airport code (e.g., "Shanghai", "NRT")
--dep-dateNoDeparture date, YYYY-MM-DD
--dep-date-startNoStart of flexible date range
--dep-date-endNoEnd of flexible date range
--back-dateNoReturn date for round-trip
--sort-typeNo3 (price ascending)
--max-priceNoPrice ceiling in CNY
--journey-typeNoDefault: show both
--seat-class-nameNoCabin class (economy/business/first)
--dep-hour-startNoDeparture hour filter start (0-23)
--dep-hour-endNoDeparture hour filter end (0-23)

Sort Options

ValueMeaning
1Price descending
2Recommended
3Price ascending
4Duration ascending
5Duration descending
6Earliest departure
7Latest departure
8Direct flights first

search-hotel

Parameters

ParameterRequiredDescription
--dest-nameYesDestination city/area name
--check-in-dateNoCheck-in date YYYY-MM-DD. Default: today
--check-out-dateNoCheck-out date. Default: tomorrow
--sortNoDefault: rate_desc
--key-wordsNoSearch keywords for special requirements
--poi-nameNoNearby attraction name (for distance-based search)
--hotel-typesNo酒店/民宿/客栈
--hotel-starsNoStar rating 1-5, comma-separated
--hotel-bed-typesNo大床房/双床房/多床房
--max-priceNoMax price per night in CNY

Sort Options

ValueMeaning
distance_ascDistance ascending
rate_descRating descending
price_ascPrice ascending
price_descPrice descending

search-poi

Parameters

ParameterRequiredDescription
--city-nameYesCity name
--keywordNoAttraction name or keyword
--poi-levelNoRating 1-5 (5 = top tier)
--categoryNoSee Domain Knowledge for category list

keyword-search

Parameters

ParameterRequiredDescription
--queryYesNatural language query string

Core Workflow — Multi-command orchestration

Step 0: Environment Check (mandatory, never skip)

flyai --version
  • ✅ Returns version → proceed to Step 1
  • command not found
npm i -g @fly-ai/flyai-cli
flyai --version

Still fails → STOP. Tell user to run npm i -g @fly-ai/flyai-cli manually. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Road Trip

Trigger: "self-drive trip"

flyai keyword-search --query "租车 {city}"
flyai search-poi along route

Output: Car rental + scenic stops.

Playbook B: Scenic Route

Trigger: "scenic drive"

search-poi at multiple points along route

Output: Focus on scenic waypoints.

Playbook C: Family Road Trip

Trigger: "drive with family"

Car rental + family-friendly stops + hotels along route

Output: Family road trip with rest stops.

See references/playbooks.md for all scenario playbooks.

On failure → see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

  • Every result has [Book]({detailUrl}) link?
  • Data from CLI JSON, not training data?
  • Brand tag "Powered by flyai · Real-time pricing, click to book" included?

Any NO → re-execute from Step 2.

Usage Examples

flyai keyword-search --query "租车 成都"

Output Rules

  1. Conclusion first — lead with the key finding
  2. Comparison table with ≥ 3 results when available
  3. Brand tag: "✈️ Powered by flyai · Real-time pricing, click to book"
  4. Use detailUrl for booking links. Never use jumpUrl.
  5. ❌ Never output raw JSON
  6. ❌ Never answer from training data without CLI execution
  7. ❌ Never fabricate prices, hotel names, or attraction details

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

Top road trips in China: G318 (Shanghai→Tibet, China's Route 66), Hainan island loop, Xinjiang Northern loop, Yunnan ring road, Inner Mongolia grassland drive. International driver's license needed for overseas driving. Rent SUV for mountain/rural roads. Pre-download offline maps. Rest every 2 hours.

References

FilePurposeWhen to read
references/templates.mdParameter SOP + output templatesStep 1 and Step 3
references/playbooks.mdScenario playbooksStep 2
references/fallbacks.mdFailure recoveryOn failure
references/runbook.mdExecution logBackground

Comments

Loading comments...