Global Flight Route Map - Airport Connections

Use local All Routes APIs, repo-backed handlers, and optional local MCP for airport, airline, route-map, timetable-context, and dataset-health lookups withou...

Security Scan

The skill is internally consistent with an offline, repo-local route-discovery tool: it requests no credentials, has no install steps, and its runtime instructions stay focused on local APIs and code inspection.

Purpose & Capability

The name/description, README, and SKILL.md all describe an offline/local route-discovery skill and the declared footprint (no env vars, no installs) generally matches that purpose. Minor inconsistency: the runtime instructions reference starting the web app and worker with `pnpm --filter ... dev`, but the skill metadata does not list pnpm (or Node) as a required binary. That is a small operational mismatch (you will need pnpm/node to run the local dev servers) but does not contradict the declared purpose.

Instruction Scope

SKILL.md restricts actions to read-only local surfaces (local /api endpoints, optional local anonymous /mcp, and repo-backed handler inspection). It explicitly forbids requiring hosted secrets, scraping third‑party sites, write actions, or browser automation. The instructions ask the agent to inspect repo files and local endpoints — which is appropriate for an offline repository-backed skill.

Install Mechanism

There is no install spec and no code files; this is instruction-only, so nothing is written to disk by the skill itself. The only operational requirement is that the environment running the agent has the normal developer tooling (e.g., pnpm/node) if the agent is expected to start local servers, but the skill does not attempt to install anything.

Credentials

The skill declares no required environment variables or credentials and the documentation explicitly forbids requiring hosted tokens (ALL_ROUTES_MCP_TOKEN). This is proportionate to the offline/local nature of the skill.

Persistence & Privilege

The skill does not request always:true or other elevated persistence. It is user-invocable and allows normal autonomous invocation (disable-model-invocation: false), which is standard for skills and appropriate here. The skill does not instruct modifying other skills or system-wide settings.

Assessment

This skill appears to do what it says: local, read-only route lookups backed by your repo. Before installing/use: (1) Ensure you trust the repository contents because the agent will be instructed to read repo files (any secrets in the repo could be exposed in responses). (2) If you want the agent to start local servers, make sure pnpm/node are available on the host (the metadata doesn't list pnpm as a required binary). (3) Confirm your environment isolates localhost services you allow the agent to contact (local anonymous MCP is intended for localhost-only). (4) If you plan to allow autonomous agent invocation, be aware the agent can call the local endpoints and read files — ensure the local repo and dev servers do not contain sensitive credentials or private data.

all air routes

Use this skill when the task needs route-discovery data grounded in this repo without depending on hosted All Routes MCP credentials.

Hosted destination (next release)

• https://all-routes.desk.travel/

Quick Start

1. Prefer local repo surfaces over hosted services or third-party browsing.
2. If the web app is available locally, use its /api/* endpoints first.
3. If the worker is available locally, you may use the local anonymous /mcp endpoint as an optional secondary path.
4. If neither server is running, inspect the repo-backed handlers and schemas directly and label the answer as code-backed/offline rather than live endpoint output.
5. Read references/local-surfaces.md for concrete endpoint mappings and startup commands.

Workflow

1) Choose the narrowest local surface

• airport search / lookup: use the local airport API surfaces.
• routes from airport / city pair: use the local routes API.
• airline route map: use the airline routes API.
• timetable context: use the timetables API.
• dataset health: use the data health API, and treat it as an ops/debug surface.

2) Prefer the no-worker path

• The primary path is local web APIs and repo-backed handlers, not hosted MCP.
• If you need live local responses, start the web app with pnpm --filter @all-routes/web dev.
• If the app is not running, inspect the local route handlers and shared schemas instead of inventing undocumented requests.

3) Use local MCP only when helpful

• If the worker is already running, or the task clearly benefits from MCP tools/resources, use the local /mcp endpoint.
• Local anonymous MCP is intended for localhost flows only; do not assume hosted credentials or ALL_ROUTES_MCP_TOKEN.
• Keep MCP requests narrow and prefer exact airport or airline codes when possible.

4) Stay read-only and grounded

• Do not require hosted secrets.
• Do not scrape arbitrary third-party sites.
• Do not invent write actions, browser automation, or remote fetch flows around this skill.
• Prefer exact IATA, ICAO, or airline codes over fuzzy queries when the user can provide them.
• Always say whether the answer came from local MCP, a local API, or offline code inspection.

5) Use prompts and explanations carefully

• When local MCP is available, plan_route_options and explain_route_coverage are valid explanation surfaces.
• Without MCP, explain route coverage using the local API response or code-backed repository behavior instead of pretending a prompt tool exists.

Reference File

• Read references/local-surfaces.md for local endpoint mappings, startup commands, and fallback guidance.