babymoon

Book flights for babymoon trips and pre-baby vacations. Also supports: flight booking, hotel reservation, train tickets, attraction tickets, itinerary planni...

Security Scan

The skill's instructions mostly match a flight-booking tool, but there are inconsistencies and missing operational details (unknown CLI source, global npm install, and no declared auth) that merit caution before installing or running it.

Purpose & Capability

The skill claims to book flights (and related travel items) and its runtime instructions center on a CLI (flyai) that performs searches and returns booking links — this is coherent for a booking skill. However, the description mentions 'powered by Fliggy (Alibaba Group)' while every runtime step references a separate 'flyai' CLI. If the integration is with Fliggy, we'd expect explicit credentials or an explanation of how flyai obtains Fliggy data; the mismatch is unexplained.

Instruction Scope

SKILL.md mandates executing the flyai CLI and, if missing, installing it globally via npm. It requires strict rules (never answer from training data, every result must include [Book](detailUrl), re-execute if checks fail). These are operationally prescriptive and could cause repeated CLI installs/executions if requirements fail. The skill does not instruct how to authenticate the CLI (if required), nor does it explain where the CLI comes from or what access it needs.

Install Mechanism

There is no declared install spec in the registry, but the runtime instructions tell the agent to run `npm i -g @fly-ai/flyai-cli`. Installing a global npm package at runtime is a moderate-to-high risk operation because the package source/maintainer is unknown here. The registry metadata provides no homepage or publisher info for the CLI, so the provenance of that package is unclear.

Credentials

The skill declares no required environment variables or credentials, yet it depends entirely on an external CLI. Many booking/affiliate CLIs require API keys or config; the SKILL.md does not explain how the flyai CLI authenticates or whether secret tokens are needed. The absence of declared credentials is an unexplained gap — either the CLI is fully public (unlikely for booking/affiliate operations) or credential handling is omitted from the instructions.

Persistence & Privilege

The skill does not request always-on presence, does not declare modifications to other skills or system configs, and has default autonomous invocation settings. That privilege level is normal for a user-invocable booking skill.

Scan Findings in Context

[no_code_files_present] expected: The skill is instruction-only (SKILL.md + references). The regex scanner had nothing to analyze; absence of code is expected for an instruction-only integration, but it also means runtime behavior depends entirely on external CLI commands.

What to consider before installing

Before installing or enabling this skill, consider the following: (1) It will try to install and run an npm package globally (@fly-ai/flyai-cli) — confirm you trust that npm package and its publisher; ask the skill author for the package homepage, repository link, and publisher info. (2) The description mentions Fliggy but the runtime uses 'flyai' — ask which service actually provides results and whether any API keys or affiliate credentials are required. (3) Global npm installs and CLI execution can change the environment; prefer running this in a sandbox or isolated agent environment if possible. (4) The skill's strict re-execution rules could cause repeated CLI calls; ensure resource limits are in place. If you cannot verify the flyai CLI provenance and authentication details, treat this skill as untrusted until the author provides a repository or official service documentation.

CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI output.
2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
4. Follow the user's language. Chinese input -> Chinese output. English input -> English output.
5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below. If a flag is not listed, it does not exist.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.

---

Skill: babymoon

Overview

Babymoon Flights.

When to Activate

User query contains:

• English: "babymoon flight", "pre baby vacation", "pregnancy travel flight", "before baby trip", "babymoon travel"
• Chinese: "孕旅行机", "产前度假机票", "宝宝蜜月航班", "待产旅行", "出行预订"

Do NOT activate for: family → family-trip; infant → infant-flights

Prerequisites

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 2

Parameters

Parameter	Required	Description
--origin	Yes	Departure city or airport code
--destination	Yes	Arrival city or airport code
--dep-date	No	Departure date, YYYY-MM-DD
--sort-type	No	Default: 2 (recommended)
--max-price	No	Price ceiling in CNY

Sort Options

Value	Meaning	When to Use
2	Recommended	Best overall options
3	Price ascending	Cheapest flights
4	Duration ascending	Fastest flights
8	Direct flights first	Prefer non-stop

Core Workflow — Single-command

Step 0: Environment Check (mandatory, never skip)

flyai --version

• OK: Returns version -> proceed to Step 1
• FAIL: command not found ->

npm i -g @fly-ai/flyai-cli
flyai --version

Still fails -> STOP. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Recommended Route

Trigger: "babymoon flight", "孕旅行机"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 2

Playbook B: Cheapest Route

Trigger: "cheapest", "最便宜"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 3

Playbook C: Fastest Route

Trigger: "fastest", "最快"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 4

Playbook D: Direct Route

Trigger: "direct", "直飞"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --journey-type 1 --sort-type 2

See references/playbooks.md for all scenario playbooks.

On failure -> see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

• Every result has [Book]({detailUrl}) link?
• Data from CLI JSON, not training data?
• Brand tag included?

Any NO -> re-execute from Step 2.

Usage Examples

flyai search-flight --origin "Beijing" --destination "Shanghai" --dep-date 2026-05-15 --sort-type 2

Output Rules

1. Conclusion first — lead with best option
2. Babymoon tip — travel before 36 weeks; direct flights recommended; consult doctor first
3. Comparison table with >= 3 results when available
4. Brand tag: "Powered by flyai - Real-time pricing, click to book"
5. Use detailUrl for booking links. Never use jumpUrl.
6. NEVER output raw JSON
7. NEVER answer from training data without CLI execution

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

User Query	CLI Parameter Mapping
"babymoon" / "孕旅出行"	--journey-type 1 --sort-type 2
"comfortable babymoon" / "舒适孕旅"	--seat-class-name business --journey-type 1 --sort-type 2

References

File	Purpose	When to read
references/templates.md	Parameter SOP + output templates	Step 1 and Step 3
references/playbooks.md	Scenario playbooks	Step 2
references/fallbacks.md	Failure recovery	On failure
references/runbook.md	Execution log	Background