Scan Report
0 /100
flyai-hotel-picker
酒店N选1决策助手，帮助用户从海量酒店中精选3家进行对比决策
The skill is a legitimate hotel selection assistant that uses FlyAI CLI commands to search hotels and POIs. No malicious behavior detected - all functionality is declared in documentation.
Safe to install
No action required. The skill is safe to use.
| Resource | Declared | Inferred | Status | Evidence |
|---|---|---|---|---|
| Filesystem | READ | READ | ✓ Aligned | SKILL.md:164 - read_file(file_path="~/.flyai/user-profile.md") |
| Shell | WRITE | WRITE | ✓ Aligned | SKILL.md:112-121 - npm install @fly-ai/flyai-cli |
| Network | READ | READ | ✓ Aligned | SKILL.md:117-119 - registry.npmmirror.com for npm install |
| Skill Invoke | READ | READ | ✓ Aligned | SKILL.md:17-20 - uses search-hotel, search-poi, search-marriott-hotel |
4 findings
Medium External URL 外部 URL
https://nodejs.org/ SKILL.md:117 Medium External URL 外部 URL
https://registry.npmmirror.com SKILL.md:119 Medium External URL 外部 URL
https://img.alicdn.com/... reference/search-hotel.md:44 Medium External URL 外部 URL
https://img.alicdn.com/tfscom/... reference/search-poi.md:32 File Tree
10 files · 27.5 KB · 913 lines Markdown 10f · 913L
├─
▾
reference
│ ├─
ai-search.md
Markdown
│ ├─
keyword-search.md
Markdown
│ ├─
search-flight.md
Markdown
│ ├─
search-hotel.md
Markdown
│ ├─
search-marriott-hotel.md
Markdown
│ ├─
search-marriott-package.md
Markdown
│ ├─
search-poi.md
Markdown
│ ├─
search-train.md
Markdown
│ └─
user-profile-storage.md
Markdown
└─
SKILL.md
Markdown
Security Positives
✓ All functionality is clearly declared in SKILL.md documentation
✓ No scripting files present - all content is documentation only
✓ No credential harvesting, API key access, or sensitive credential patterns found
✓ No base64 encoding, obfuscation, or anti-analysis patterns detected
✓ No reverse shell, C2 communication, or data exfiltration indicators
✓ No hidden instructions in HTML comments or documentation
✓ Skill uses legitimate FlyAI CLI tool for hotel/POI search
✓ User profile access is declared and serves the stated purpose
✓ External URLs (npm registry) are necessary for CLI tool installation