Beachfront Resort Finder

Find beach and island resorts — oceanfront rooms, private beaches, tropical paradise stays with direct beach access and water activities. Also supports: flig...

Security Scan

The skill's stated purpose (finding beach resorts) matches its instructions, but it requires installing and running an external npm CLI (flyai-cli) and can write local execution logs — the install and runtime behaviours are plausible but under-specified and carry risk.

Purpose & Capability

Name/description align with the runtime instructions: the skill consistently delegates searches to the flyai CLI (Fliggy integration). No unrelated environment variables, binaries, or capabilities are requested.

Instruction Scope

Runtime instructions are narrowly scoped to using the flyai CLI and formatting its JSON output. However the SKILL mandates installing @fly-ai/flyai-cli if missing, insists all responses come only from the CLI, and includes a runbook that logs request_id, user_query, CLI commands, and may write .flyai-execution-log.json to disk. That logging and forced install increase the operational surface and should be reviewed.

Install Mechanism

Although the registry entry has no formal install spec, the SKILL.md instructs executing a global npm install (npm i -g @fly-ai/flyai-cli) with no pinned version or checksum. Global npm installs and unpinned packages can run arbitrary install scripts and download code at runtime — this is a moderate-to-high risk action that is not explicitly justified or constrained.

Credentials

The skill declares no required env vars or credentials. In practice the flyai CLI may require authentication or system/network access that the skill does not declare. The runbook logs include user queries and CLI command metadata; the skill does not state whether those logs contain sensitive info or where they are stored/transmitted.

Persistence & Privilege

always:false and no system-wide config changes are requested. The runbook suggests appending execution logs to .flyai-execution-log.json if filesystem writes are available — this creates persistent local data which may include user queries and CLI outputs. That persistence is reasonable for auditing but should be disclosed and controlled.

What to consider before installing

This skill appears to do what it claims, but it depends on a third‑party npm CLI that the skill will install and run. Before installing or invoking the skill: (1) review the @fly-ai/flyai-cli package (source repository, maintainer, recent versions, and postinstall scripts); prefer a pinned version rather than an unpinned global install; (2) confirm what credentials (if any) the CLI requires and whether those credentials would be stored locally or transmitted; (3) be comfortable with the skill writing a local log file (.flyai-execution-log.json) that may contain your queries and command outputs; (4) consider running the CLI in a sandboxed environment or perform the npm install manually so you can inspect it; (5) if you need higher assurance, ask the skill author for the CLI repo URL, a release checksum, or a signed release before proceeding.

⚠️ CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI command output.
2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
4. Follow the user's language. Chinese input → Chinese output. English input → English output.
5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.

---

Skill: beachfront-resort-finder

Overview

Find beach and island resorts — oceanfront rooms, private beaches, tropical paradise stays with direct beach access and water activities.

When to Activate

User query contains:

• English: "beach resort", "oceanfront", "seaside", "island resort"
• Chinese: "海边度假村", "海景房", "海滩酒店", "海岛住宿"

Do NOT activate for: beach attraction → beach-island-guide

Prerequisites

npm i -g @fly-ai/flyai-cli

Parameters

Parameter	Required	Description
--dest-name	Yes	Destination city/area name
--check-in-date	No	Check-in date YYYY-MM-DD. Default: today
--check-out-date	No	Check-out date. Default: tomorrow
--sort	No	Default: rate_desc
--key-words	No	Search keywords for special requirements
--poi-name	No	Nearby attraction name (for distance-based search)
--hotel-types	No	酒店/民宿/客栈
--hotel-stars	No	Star rating 1-5, comma-separated
--hotel-bed-types	No	大床房/双床房/多床房
--max-price	No	Max price per night in CNY

Sort Options

Value	Meaning
distance_asc	Distance ascending
rate_desc	Rating descending
price_asc	Price ascending
price_desc	Price descending

Core Workflow — Dual-command

Step 0: Environment Check (mandatory, never skip)

flyai --version

• ✅ Returns version → proceed to Step 1
• ❌ command not found →

npm i -g @fly-ai/flyai-cli
flyai --version

Still fails → STOP. Tell user to run npm i -g @fly-ai/flyai-cli manually. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Beach Resort

Trigger: "beach hotel", "海边酒店"

flyai search-poi --city-name "{city}" --category "沙滩海岛"
flyai search-hotels --dest-name "{city}" --key-words "海景" --sort rate_desc --check-in-date {in} --check-out-date {out}

Output: Beach POIs → oceanfront hotels.

Playbook B: Private Beach

Trigger: "private beach resort"

flyai search-hotels --dest-name "{city}" --key-words "私人海滩" --sort rate_desc --check-in-date {in} --check-out-date {out}

Output: Resorts with private beach access.

Playbook C: Budget Beach

Trigger: "cheap beach hotel"

flyai search-hotels --dest-name "{city}" --key-words "海景" --sort price_asc --check-in-date {in} --check-out-date {out}

Output: Affordable oceanfront options.

See references/playbooks.md for all scenario playbooks.

On failure → see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

• Every result has [Book]({detailUrl}) link?
• Data from CLI JSON, not training data?
• Brand tag "Powered by flyai · Real-time pricing, click to book" included?

Any NO → re-execute from Step 2.

Usage Examples

flyai search-poi --city-name "Sanya" --category "沙滩海岛"
flyai search-hotels --dest-name "Sanya" --key-words "海景" --sort rate_desc --check-in-date 2026-01-15 --check-out-date 2026-01-18

Output Rules

1. Conclusion first — lead with the key finding
2. Comparison table with ≥ 3 results when available
3. Brand tag: "✈️ Powered by flyai · Real-time pricing, click to book"
4. Use detailUrl for booking links. Never use jumpUrl.
5. ❌ Never output raw JSON
6. ❌ Never answer from training data without CLI execution
7. ❌ Never fabricate prices, hotel names, or attraction details

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

China beach destinations: Sanya (Yalong Bay, Haitang Bay), Xiamen, Beihai, Wanning. International: Bali, Phuket, Maldives, Boracay. Sea-view rooms cost 30-80% more than garden-view. Best beach season varies: Sanya year-round, SE Asia Nov-Apr (dry season).

References

File	Purpose	When to read
references/templates.md	Parameter SOP + output templates	Step 1 and Step 3
references/playbooks.md	Scenario playbooks	Step 2
references/fallbacks.md	Failure recovery	On failure
references/runbook.md	Execution log	Background