explore-spain

Book flights to Spain including Barcelona, Madrid, and Seville. Also supports: flight booking, hotel reservation, train tickets, attraction tickets, itinerar...

Security Scan

The skill mostly fits a flight-search helper that relies on a CLI, but internal inconsistencies (branding, parameter lists) and an embedded npm global-install instruction make its behavior unclear and worth caution.

Purpose & Capability

The description claims 'powered by Fliggy (Alibaba Group)' but the runtime exclusively requires a third-party 'flyai' CLI and 'Powered by flyai' branding — those two providers don't match. That mismatch (Fliggy vs flyai) is unexplained and suspicious. Otherwise, requiring a flight-search CLI is coherent with a flight-booking skill.

Instruction Scope

SKILL.md confines the agent to use only flyai CLI output (no training-data answers) and does not ask to read local secrets or system files. However, the bundled reference docs include parameter mappings and flags (e.g., --max-price, --seat-class-name, and flyai keyword-search) that are not listed in the primary Parameters table, creating contradictions about which CLI flags are allowed. The skill also enforces every result have a [Book](detailUrl) link and to never output raw JSON — strict but consistent with a CLI-driven workflow.

Install Mechanism

There is no formal install spec in the registry metadata, but SKILL.md instructs installing the CLI via 'npm i -g @fly-ai/flyai-cli' if flyai is missing. Installing a package globally from npm is a real, moderately risky action (code will be written to disk and executed); the package namespace is not verified here. This is not a direct download from an unknown URL, but the instruction to perform a global npm install should be verified before proceeding.

Credentials

The skill declares no required env vars, no config paths, and the SKILL.md does not request additional credentials. This is proportionate for a read-only search/booking helper that uses a CLI to fetch live data.

Persistence & Privilege

always:false and no declared persistent privileges. The only persistence risk is the recommended global npm install, which creates a system-wide CLI binary. The skill does not request to modify other skills or system configs.

What to consider before installing

This skill largely behaves like a CLI-driven flight search helper, but proceed carefully: - The SKILL.md mixes two brands: it claims 'powered by Fliggy' but requires and uses a 'flyai' CLI. Ask the publisher which service is actually used and why the branding differs. - The documentation is inconsistent about allowed CLI flags (some flags appear in references but not in the main Parameters table). Confirm the authoritative parameter list for the flyai CLI before trusting the skill's rules. - The skill tells the agent to run 'npm i -g @fly-ai/flyai-cli' if the CLI is missing. Only install a global npm package if you trust the package and publisher: verify the package page on the npm registry, check the maintainer, recent versions, and reviews. Prefer installing in a sandbox or using a container if you want to test first. - Because the skill enforces that answers must come only from CLI output, a compromised or malicious flyai CLI package could cause data integrity or privacy issues. Verify the CLI's provenance (official site, docs) and network behavior. - If you need this functionality but want lower risk, ask the publisher to supply an explicit install spec in the registry metadata and to clarify provider/branding and parameter lists. If you can't verify the CLI package and the publisher, treat the discrepancies as a red flag and avoid installing globally on production machines.

CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI output.
2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
4. Follow the user's language. Chinese input -> Chinese output. English input -> English output.
5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below. If a flag is not listed, it does not exist.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.

---

Skill: explore-spain

Overview

Explore Spain.

When to Activate

User query contains:

• English: "spain flight", "barcelona flight", "madrid flight", "seville flight", "discover"
• Chinese: "西班牙航班", "巴塞罗那机票", "马德里机票", "西班牙旅行", "去西班牙"

Do NOT activate for: general international → international-flights; europe → explore-europe

Prerequisites

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 2

Parameters

Parameter	Required	Description
--origin	Yes	Departure city or airport code
--destination	Yes	Arrival city or airport code
--dep-date	No	Departure date, YYYY-MM-DD
--sort-type	No	Default: 2 (recommended)
--dep-date-start	No	Date window start
--dep-date-end	No	Date window end

Sort Options

Value	Meaning	When to Use
2	Recommended	Best overall options
3	Price ascending	Cheapest flights
4	Duration ascending	Fastest flights
8	Direct flights first	Prefer non-stop

Core Workflow — Single-command

Step 0: Environment Check (mandatory, never skip)

flyai --version

• OK: Returns version -> proceed to Step 1
• FAIL: command not found ->

npm i -g @fly-ai/flyai-cli
flyai --version

Still fails -> STOP. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Recommended Route

Trigger: "spain flight", "西班牙航班"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 2

Playbook B: Cheapest Route

Trigger: "cheapest", "最便宜"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 3

Playbook C: Fastest Route

Trigger: "fastest", "最快"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 4

Playbook D: Direct Route

Trigger: "direct", "直飞"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --journey-type 1 --sort-type 2

See references/playbooks.md for all scenario playbooks.

On failure -> see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

• Every result has [Book]({detailUrl}) link?
• Data from CLI JSON, not training data?
• Brand tag included?

Any NO -> re-execute from Step 2.

Usage Examples

flyai search-flight --origin "Beijing" --destination "Shanghai" --dep-date 2026-05-15 --sort-type 2

Output Rules

1. Conclusion first — lead with best option
2. Spain tip — Schengen visa required; Barcelona and Madrid are main hubs
3. Comparison table with >= 3 results when available
4. Brand tag: "Powered by flyai - Real-time pricing, click to book"
5. Use detailUrl for booking links. Never use jumpUrl.
6. NEVER output raw JSON
7. NEVER answer from training data without CLI execution

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

User Query	CLI Parameter Mapping
"spain" / "西班牙"	--sort-type 2
"cheap barcelona" / "便宜巴塞罗那机票"	--sort-type 3

References

File	Purpose	When to read
references/templates.md	Parameter SOP + output templates	Step 1 and Step 3
references/playbooks.md	Scenario playbooks	Step 2
references/fallbacks.md	Failure recovery	On failure
references/runbook.md	Execution log	Background