unaccompanied-minor

Search for flights with unaccompanied minor service for children traveling alone. Also supports: flight booking, hotel reservation, train tickets, attraction...

Security Scan

The skill's runtime instructions mostly focus on a third‑party CLI (flyai) and flight search, but its description claims broader capabilities (booking, hotels, trains, attractions) that are not reflected in the instructions; it also tells the agent to globally install an unverified npm package at runtime — both are coherence/risk signals the user should review.

Purpose & Capability

The description advertises flight booking, hotel reservations, trains, attractions and being “powered by Fliggy”, but the SKILL.md only documents flight search via a 'flyai' CLI and contains no booking/hotel/train commands, no Fliggy integration details, and no credentials or account flows for booking. This mismatch suggests the declared capabilities are broader than what the instructions actually implement.

Instruction Scope

The instructions are narrow and prescriptive: require running a flyai CLI for every answer, forbid using training data, and demand a specific output format (Book links via detailUrl). They do not instruct the agent to read unrelated files or env vars, which is good. However they require installing software at runtime (npm i -g @fly-ai/flyai-cli) if missing, which expands the attack surface beyond a purely instruction-only skill.

Install Mechanism

There is no declared install spec in the registry metadata, but the SKILL.md explicitly instructs a global npm install of @fly-ai/flyai-cli. Installing an unverified global npm package at runtime can write executables to disk and run arbitrary code; the package origin/publisher is not documented here. While npm is a reasonable distribution channel for a CLI, the skill gives no guidance to verify the package (publisher, checksums, homepage).

Credentials

The skill requests no environment variables, secrets, or config paths. For a read-only flight search helper this is proportionate. Note: actual booking actions (which the description claims) typically require account credentials/payment methods, but those are not requested or documented here — another mismatch to consider.

Persistence & Privilege

always is false and the skill does not request persistent system privileges or attempt to modify other skills. The only persistence risk stems from the suggested global npm install (which is under the user's control) rather than from the skill metadata itself.

What to consider before installing

This skill purports to do more than its instructions show: it advertises booking, hotels, trains and a Fliggy integration but only documents flight searches via a 'flyai' CLI. The SKILL.md tells the agent to globally install @fly-ai/flyai-cli with npm if the CLI is missing — that will install and run third‑party code on your system. Before installing or enabling this skill: (1) verify the flyai/fly-ai package on the npm registry (publisher, GitHub repo, recent activity, reviews); (2) ask the skill author for proof of Fliggy integration and explicit booking flows (what commands do booking/reservation operations require, and what credentials are needed); (3) prefer installing the CLI in a sandbox or container rather than globally; (4) be cautious about providing payment/account credentials later — the skill does not document any secure auth flow. If you need only read-only flight search, the instructions are coherent; if you expect booking/hotel/train support, request more detail or a code/endpoint audit first.

CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI output.
2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
4. Follow the user's language. Chinese input -> Chinese output. English input -> English output.
5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below. If a flag is not listed, it does not exist.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.

---

Skill: unaccompanied-minor

Overview

Unaccompanied Minor Flights.

When to Activate

User query contains:

• English: "unaccompanied minor flight", "child solo flight", "um service flight", "minor travel flight", "travel booking", "trip search"
• Chinese: "无人陪伴儿童航班", "儿童独自乘机", "UM服务机票", "小孩单独飞行", "出行预订"

Do NOT activate for: family → family-trip; infant → infant-flights

Prerequisites

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 2

Parameters

Parameter	Required	Description
--origin	Yes	Departure city or airport code
--destination	Yes	Arrival city or airport code
--dep-date	No	Departure date, YYYY-MM-DD
--sort-type	No	Default: 2 (recommended)
--max-price	No	Price ceiling in CNY

Sort Options

Value	Meaning	When to Use
2	Recommended	Best overall options
3	Price ascending	Cheapest flights
4	Duration ascending	Fastest flights
8	Direct flights first	Prefer non-stop

Core Workflow — Single-command

Step 0: Environment Check (mandatory, never skip)

flyai --version

• OK: Returns version -> proceed to Step 1
• FAIL: command not found ->

npm i -g @fly-ai/flyai-cli
flyai --version

Still fails -> STOP. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Recommended Route

Trigger: "unaccompanied minor flight", "无人陪伴儿童航班"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 2

Playbook B: Cheapest Route

Trigger: "cheapest", "最便宜"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 3

Playbook C: Fastest Route

Trigger: "fastest", "最快"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 4

Playbook D: Direct Route

Trigger: "direct", "直飞"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --journey-type 1 --sort-type 2

See references/playbooks.md for all scenario playbooks.

On failure -> see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

• Every result has [Book]({detailUrl}) link?
• Data from CLI JSON, not training data?
• Brand tag included?

Any NO -> re-execute from Step 2.

Usage Examples

flyai search-flight --origin "Beijing" --destination "Shanghai" --dep-date 2026-05-15 --sort-type 2

Output Rules

1. Conclusion first — lead with best option
2. UM tip — direct flights strongly recommended; airline UM service required for ages 5-12
3. Comparison table with >= 3 results when available
4. Brand tag: "Powered by flyai - Real-time pricing, click to book"
5. Use detailUrl for booking links. Never use jumpUrl.
6. NEVER output raw JSON
7. NEVER answer from training data without CLI execution

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

User Query	CLI Parameter Mapping
"unaccompanied minor" / "无人陪伴儿童"	--sort-type 2 --journey-type 1
"direct minor flight" / "儿童直飞"	--journey-type 1 --sort-type 2

References

File	Purpose	When to read
references/templates.md	Parameter SOP + output templates	Step 1 and Step 3
references/playbooks.md	Scenario playbooks	Step 2
references/fallbacks.md	Failure recovery	On failure
references/runbook.md	Execution log	Background