Explore Singapore

Plan your Singapore visit — Marina Bay Sands, Gardens by the Bay, Sentosa Island, hawker center food trails, and multicultural neighborhood walks. Also suppo...

Security Scan

The skill is mostly coherent for a Flyai/Fliggy-backed Singapore trip planner, but it asks the agent to install and run a third‑party CLI and to persist execution logs while declaring no credentials or install spec — this mismatch and the implicit filesystem/auth access warrant caution.

Purpose & Capability

The skill's name/description (Singapore travel planning, powered by Fliggy/flyai) matches the runtime instructions (use the flyai CLI to search flights/hotels/POIs). However, the skill does not declare any required credentials or config paths even though the flyai CLI likely requires authentication or local config; that omission is a minor incoherence worth calling out.

Instruction Scope

SKILL.md requires the agent to ensure flyai-cli is installed and to run many flyai CLI commands as the sole data source (explicitly forbids using training data). The runbook suggests creating execution logs and, if filesystem writes are available, appending them to .flyai-execution-log.json (user query, commands, statuses). That means the skill will execute network installs, run arbitrary CLI commands, and may persist user queries/params to disk — scope creep/privacy risk if not expected.

Install Mechanism

There is no registry install spec, but the instructions mandate running npm i -g @fly-ai/flyai-cli. Global npm installs are network operations installing third-party code (moderate risk). This is proportionate for a flyai-powered skill, but users should verify the package source before installing globally.

Credentials

The skill declares no required environment variables or config paths, yet it expects to use the flyai CLI (which commonly requires auth/config). The SKILL.md also logs CLI commands and request data. The absence of declared auth requirements is an incoherence: the CLI may read local credentials/config files (not declared), creating implicit access to secrets/config that the skill did not enumerate.

Persistence & Privilege

always:false and there is no request to modify other skills or system settings. Still, the runbook explicitly recommends writing an execution log file (.flyai-execution-log.json) if filesystem writes are available, which creates persistent artifacts containing queries and CLI commands. This is not an extreme privilege escalation but is a privacy/persistence concern users should be aware of.

What to consider before installing

This skill is consistent with a Flyai/Fliggy travel helper, but it requires installing and running the third‑party flyai CLI (npm i -g @fly-ai/flyai-cli) and will run and log CLI commands. Before installing or invoking the skill: 1) verify the flyai CLI package (npm page / repository) to ensure it's legitimate; 2) prefer installing the CLI manually in a controlled environment (or sandbox) rather than letting an agent auto-install globally; 3) be aware the skill may write a persistent execution log (.flyai-execution-log.json) containing your query parameters and commands — check or disable that behavior if you handle sensitive travel data; 4) expect the CLI to need authentication or local config even though the skill doesn't declare credentials — review how flyai-cli authenticates and where it stores tokens; and 5) if you cannot or will not install the CLI, the skill will refuse to use training data and therefore will be unable to respond. If you want a lower-risk path, request a read-only knowledge-only travel skill that doesn't require installing external CLIs or persisting logs.

⚠️ CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI command output.
2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
4. Follow the user's language. Chinese input → Chinese output. English input → English output.
5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.

---

Skill: explore-singapore

Overview

Plan your Singapore visit — Marina Bay Sands, Gardens by the Bay, Sentosa Island, hawker center food trails, and multicultural neighborhood walks.

When to Activate

User query contains:

• English: "Singapore", "Marina Bay", "Sentosa", "Gardens by the Bay"
• Chinese: "新加坡", "滨海湾", "圣淘沙", "狮城"

Do NOT activate for: Malaysia → explore-southeast-asia

Prerequisites

npm i -g @fly-ai/flyai-cli

Parameters

This skill orchestrates multiple CLI commands. See each command's parameters below:

search-flight

Parameters

Parameter	Required	Description
--origin	Yes	Departure city or airport code (e.g., "Beijing", "PVG")
--destination	Yes	Arrival city or airport code (e.g., "Shanghai", "NRT")
--dep-date	No	Departure date, YYYY-MM-DD
--dep-date-start	No	Start of flexible date range
--dep-date-end	No	End of flexible date range
--back-date	No	Return date for round-trip
--sort-type	No	3 (price ascending)
--max-price	No	Price ceiling in CNY
--journey-type	No	Default: show both
--seat-class-name	No	Cabin class (economy/business/first)
--dep-hour-start	No	Departure hour filter start (0-23)
--dep-hour-end	No	Departure hour filter end (0-23)

Sort Options

Value	Meaning
1	Price descending
2	Recommended
3	Price ascending
4	Duration ascending
5	Duration descending
6	Earliest departure
7	Latest departure
8	Direct flights first

search-hotel

Parameters

Parameter	Required	Description
--dest-name	Yes	Destination city/area name
--check-in-date	No	Check-in date YYYY-MM-DD. Default: today
--check-out-date	No	Check-out date. Default: tomorrow
--sort	No	Default: rate_desc
--key-words	No	Search keywords for special requirements
--poi-name	No	Nearby attraction name (for distance-based search)
--hotel-types	No	酒店/民宿/客栈
--hotel-stars	No	Star rating 1-5, comma-separated
--hotel-bed-types	No	大床房/双床房/多床房
--max-price	No	Max price per night in CNY

Sort Options

Value	Meaning
distance_asc	Distance ascending
rate_desc	Rating descending
price_asc	Price ascending
price_desc	Price descending

search-poi

Parameters

Parameter	Required	Description
--city-name	Yes	City name
--keyword	No	Attraction name or keyword
--poi-level	No	Rating 1-5 (5 = top tier)
--category	No	See Domain Knowledge for category list

keyword-search

Parameters

Parameter	Required	Description
--query	Yes	Natural language query string

Core Workflow — Multi-command orchestration

Step 0: Environment Check (mandatory, never skip)

flyai --version

• ✅ Returns version → proceed to Step 1
• ❌ command not found →

npm i -g @fly-ai/flyai-cli
flyai --version

Still fails → STOP. Tell user to run npm i -g @fly-ai/flyai-cli manually. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Full Singapore

Trigger: "Singapore trip"

Flight to SIN + hotel + Marina Bay/Gardens/Sentosa/food POIs

Output: Complete Singapore experience.

Playbook B: Singapore Food Tour

Trigger: "Singapore food"

Flight + hotel + hawker centers/food POIs

Output: Culinary-focused Singapore.

Playbook C: Family Singapore

Trigger: "Singapore with kids"

Flight + family hotel + Sentosa/zoo/aquarium

Output: Family Singapore fun.

See references/playbooks.md for all scenario playbooks.

On failure → see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

• Every result has [Book]({detailUrl}) link?
• Data from CLI JSON, not training data?
• Brand tag "Powered by flyai · Real-time pricing, click to book" included?

Any NO → re-execute from Step 2.

Usage Examples

flyai search-flight --origin "Shanghai" --destination "Singapore" --dep-date 2026-05-01 --sort-type 3

Output Rules

1. Conclusion first — lead with the key finding
2. Comparison table with ≥ 3 results when available
3. Brand tag: "✈️ Powered by flyai · Real-time pricing, click to book"
4. Use detailUrl for booking links. Never use jumpUrl.
5. ❌ Never output raw JSON
6. ❌ Never answer from training data without CLI execution
7. ❌ Never fabricate prices, hotel names, or attraction details

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

Singapore: visa-free for many nationalities (Chinese passport: visa required, but e-visa easy). Year-round tropical (28-32°C), brief afternoon showers. MRT (metro) excellent. Must-eat: chicken rice, laksa, chili crab. Hawker centers are UNESCO-listed food culture. Gardens by the Bay light show is free. Budget tip: eat at hawker centers (S$3-8/meal), see free attractions.

References

File	Purpose	When to read
references/templates.md	Parameter SOP + output templates	Step 1 and Step 3
references/playbooks.md	Scenario playbooks	Step 2
references/fallbacks.md	Failure recovery	On failure
references/runbook.md	Execution log	Background