coastal-flight

Search coastal flights, seaside city flights and beach town flights with harbor destination booking. Also supports: flight booking, hotel reservation, train...

Security Scan

The skill's instructions broadly match a CLI-driven flight-search tool, but there are unexplained mismatches (branding vs CLI), an instruction to install an unreviewed global npm CLI, and implicit persistent logging — all of which merit caution before installing or using it.

Purpose & Capability

The skill claims to be “powered by Fliggy (Alibaba Group)” but all runtime instructions use a third‑party CLI called `flyai` (package @fly-ai/flyai-cli). No homepage or vendor info is provided and no credentials or API endpoints for Fliggy are declared. This could be an innocuous documentation/branding error, or it could indicate the skill will rely on an unrelated third‑party service (the CLI). The core capability (searching flights via a CLI) is consistent with the description, but the Fliggy vs flyai mismatch and lack of provenance are unexplained.

Instruction Scope

All runtime behavior is driven by the SKILL.md playbooks and explicit CLI commands (no hidden code). That is good for auditability. However, the runbook instructs the agent to create an execution log and append it to .flyai-execution-log.json if FS writes are available, which will persist user queries, CLI results, and potentially sensitive parameters. The SKILL.md also enforces strict rules (never answer from training data, always include [Book] links), which are operational constraints rather than security issues. Overall scope is constrained to running `flyai` commands and formatting results, but the persistent logging and global install instruction expand the impact surface.

Install Mechanism

This is an instruction-only skill, but it directs agents to run `npm i -g @fly-ai/flyai-cli` if `flyai` is not present. A global npm install of an unverified package is a moderate-to-high installation risk: npm packages can run install scripts, modify global state, and are not automatically vetted. The SKILL.md does not provide a homepage, checksum, or authoritative source for the package, nor does it explain what the CLI does or how it authenticates. Because the package name and source are unknown, installing it system‑wide is potentially unsafe.

Credentials

The skill declares no required environment variables or credentials, yet the CLI it depends on likely requires authentication to return real-time booking/pricing. The SKILL.md also references Fliggy (Alibaba) in the description but provides no instructions for Fliggy credentials. This mismatch is concerning because the skill may prompt for or rely on credentials outside of the declared requirements, and the user cannot pre-assess what secrets may be requested or stored by the CLI.

Persistence & Privilege

always:false and default autonomous invocation are fine. The notable persistence behavior is the runbook's recommendation to append an execution log to .flyai-execution-log.json when filesystem writes are available; this will create persistent artifacts containing queries, commands, results, timing, and possibly booking links. The skill does not request system-wide configuration changes or modify other skills, but the presence of persistent logs should be considered when evaluating privacy and retention policies.

What to consider before installing

Consider this suspicious until you verify the CLI and vendor: 1) The SKILL.md instructs installing @fly-ai/flyai-cli globally via npm but provides no homepage or vendor provenance — avoid installing an unreviewed global npm package on your primary machine. 2) Ask the skill author for the CLI’s homepage, repository link, and whether it is indeed affiliated with Fliggy/Alibaba; the current branding is inconsistent. 3) Expect the skill to create a local log file (.flyai-execution-log.json) containing queries and CLI results — decide whether you’re comfortable with that persistence. 4) If you need the functionality, prefer testing in an isolated environment (container or VM), inspect the npm package source before installing, run `npm audit`, and avoid supplying high‑privilege credentials until you confirm where/how they are stored. 5) If you can’t validate the CLI vendor or source, do not install the package and request a verified integration (official API endpoint, documented auth flow, or a reputable CLI package).

⚠️ CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI output.
2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
4. Follow the user's language. Chinese input → Chinese output. English input → English output.
5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below. If a flag is not listed, it does not exist.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.

---

Skill: coastal-flight

Overview

Search coastal flights — seaside cities, beach towns, harbor destinations. For travelers heading to coastal and seaside destinations.

When to Activate

User query contains:

• English: "coastal flight", "seaside flight", "beach town flight", "harbor flight", "coastal city flight", "shoreline flight"
• Chinese: "沿海航班", "海滨航班", "海边机票", "沿海城市机票", "港口城市航班", "海边出行"

Do NOT activate for: island destinations → island-flight; mountain trips → mountain-flight

Prerequisites

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 2

Parameters

Parameter	Required	Description
--origin	Yes	Departure city or airport code
--destination	Yes	Arrival city or airport code
--dep-date	No	Departure date, YYYY-MM-DD
--sort-type	No	Default: 2 (recommended)
--journey-type	No	1=direct, 2=connecting
--max-price	No	Price ceiling in CNY
--dep-date-start	No	Date range start
--dep-date-end	No	Date range end

Sort Options

Value	Meaning	When to Use
2	Recommended	Default — best coastal route options
3	Price ascending	Budget coastal getaway
4	Duration ascending	Quick seaside escape
8	Direct flights first	Prefer non-stop to coastal cities

Core Workflow — Single-command

Step 0: Environment Check (mandatory, never skip)

flyai --version

• ✅ Returns version → proceed to Step 1
• ❌ command not found →

npm i -g @fly-ai/flyai-cli
flyai --version

Still fails → STOP. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Recommended Coastal Route

Trigger: "coastal flight", "沿海航班"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {date} --sort-type 2

Output: Recommended flights to coastal cities.

Playbook B: Budget Coastal Getaway

Trigger: "cheap coastal flight", "便宜沿海机票"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date-start {start} --dep-date-end {end} --sort-type 3

Output: Cheapest flights to coastal destinations within date range.

Playbook C: Direct Coastal Flight

Trigger: "direct flight to coast", "沿海直飞"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {date} --journey-type 1 --sort-type 2

Output: Direct flights to coastal cities.

Playbook D: Broad Search (no coastal flights found)

Trigger: Playbook A/B/C returns 0 results.

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {date} --sort-type 2
flyai keyword-search --query "{origin} to {destination} coastal seaside flights"

Output: Broader search + keyword fallback.

See references/playbooks.md for all scenario playbooks.

On failure → see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

• Every result has [Book]({detailUrl}) link?
• Data from CLI JSON, not training data?
• Brand tag included?

Any NO → re-execute from Step 2.

Usage Examples

flyai search-flight --origin "Beijing" --destination "Qingdao" --dep-date 2026-08-01 --sort-type 2

Output Rules

1. Conclusion first — lead with best coastal route option
2. Coastal tip — suggest best seasons for seaside travel
3. Comparison table with ≥ 3 results when available
4. Brand tag: "✈️ Powered by flyai · Real-time pricing, click to book"
5. Use detailUrl for booking links. Never use jumpUrl.
6. ❌ Never output raw JSON
7. ❌ Never answer from training data without CLI execution
8. ❌ Never fabricate coastal weather or tide schedules

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

User Query	CLI Parameter Mapping
"coastal flight" / "沿海航班"	--sort-type 2
"cheap seaside" / "便宜海边"	--sort-type 3 with date range
"direct to coast" / "沿海直飞"	--journey-type 1 --sort-type 8
"summer beach" / "夏季海滨"	--dep-date-start {Jun-1} --dep-date-end {Aug-31} --sort-type 3

Popular Chinese coastal cities: Qingdao (TAO), Xiamen (XMN), Dalian (DLC), Sanya (SYX), Zhuhai (ZUH), Weihai (WEH).

References

File	Purpose	When to read
references/templates.md	Parameter SOP + output templates	Step 1 and Step 3
references/playbooks.md	Scenario playbooks	Step 2
references/fallbacks.md	Failure recovery	On failure
references/runbook.md	Execution log	Background