Fall Foliage

Find the best fall foliage destinations — golden ginkgo avenues, red maple mountains, and amber larch forests with peak color timing and photography tips. Al...

Security Scan

The skill's purpose (finding and booking fall‑foliage travel) mostly matches its instructions to use an external flyai CLI, but there are inconsistencies and missing pieces — e.g., it assumes installing a global npm package (npm not declared), provides non-CLI playbook lines, and logs potentially sensitive query data to disk without describing authentication — so install only after verifying the external CLI and logging behavior.

Purpose & Capability

Name/description (fall foliage + travel bookings via Fliggy) align with the SKILL.md: all runtime actions are centered on calling a flyai CLI and returning booking links. No unrelated services or env creds are requested in the manifest.

Instruction Scope

Instructions require running the flyai CLI for every answer and forbid using training data. They instruct installing a global npm package if missing and mandate that every result include a [Book]({detailUrl}) link. The runbook instructs persisting an execution log (.flyai-execution-log.json) which may contain raw user queries and CLI outputs (potentially sensitive). Some playbooks contain natural-language lines (e.g., 'Flight to Japan (Nov) + Kyoto hotel + maple temple POIs') that are not valid CLI invocations, contradicting the rule 'NEVER invent CLI parameters' — this is an internal inconsistency.

Install Mechanism

The skill has no packaged install spec but instructs the agent to run 'npm i -g @fly-ai/flyai-cli' when the CLI is missing. Global npm install is a common distribution mechanism but the manifest did not declare npm/node or require binaries, and there is no verification of package origin beyond npm. This is moderate-risk but explainable for a CLI-driven skill.

Credentials

The skill declares no environment variables or credentials, yet it promises booking/fliggy functionality that ordinarily requires authentication. The SKILL.md does not describe how credentials are provided to the flyai CLI (env vars, interactive auth, config files), which is a meaningful omission. Additionally, logging full queries and CLI results to disk could capture personal data without explaining retention or protections.

Persistence & Privilege

always:false (normal). The runbook suggests appending logs to .flyai-execution-log.json if filesystem writes are available — this gives the skill persistent local state. The skill does not request system-wide config changes or modify other skills, but global npm installation may require elevated permissions and persists a new binary on the system.

What to consider before installing

What to check before installing: - The skill relies on an external CLI (flyai) and will ask to run a global npm install (npm i -g @fly-ai/flyai-cli). Verify the npm package name and publisher on the npm registry and be comfortable installing global packages. - The skill does not state how booking/Fliggy authentication is handled. Expect the flyai CLI to require credentials; confirm where those credentials are stored and whether they are needed before use. - The runbook will append execution logs to .flyai-execution-log.json if writes are available. Those logs may include your raw queries and CLI responses (which can contain personal/travel data). Decide whether persistent local logging is acceptable. - There are internal inconsistencies (some playbooks use natural-language directives rather than actual CLI commands), which could cause failures or unexpected behavior. If you plan to use the skill for bookings, test it in a safe environment first and confirm network and permission requirements. - If you are not comfortable installing an external CLI or having local logs, do not install the skill; alternatively, ask the skill author for clarifications on authentication, log retention, and a verified package homepage/source.

⚠️ CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI command output.
2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
4. Follow the user's language. Chinese input → Chinese output. English input → English output.
5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.

---

Skill: autumn-foliage-trip

Overview

Find the best fall foliage destinations — golden ginkgo avenues, red maple mountains, and amber larch forests with peak color timing and photography tips.

When to Activate

User query contains:

• English: "autumn leaves", "fall foliage", "maple", "ginkgo", "autumn colors"
• Chinese: "红叶", "秋天去哪", "赏秋", "银杏", "枫叶"

Do NOT activate for: cherry blossom → cherry-blossom-trip

Prerequisites

npm i -g @fly-ai/flyai-cli

Parameters

Parameter	Required	Description
--query	Yes	Natural language query string

Core Workflow — Multi-command orchestration

Step 0: Environment Check (mandatory, never skip)

flyai --version

• ✅ Returns version → proceed to Step 1
• ❌ command not found →

npm i -g @fly-ai/flyai-cli
flyai --version

Still fails → STOP. Tell user to run npm i -g @fly-ai/flyai-cli manually. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Kyoto Autumn

Trigger: "Kyoto autumn leaves"

Flight to Japan (Nov) + Kyoto hotel + maple temple POIs

Output: Kyoto fall foliage pilgrimage.

Playbook B: China Autumn

Trigger: "autumn leaves in China"

flyai search-poi --city-name "{city}" --keyword "红叶"

Output: Domestic fall foliage spots.

Playbook C: Ginkgo Avenue

Trigger: "ginkgo trees"

flyai search-poi --city-name "{city}" --keyword "银杏"

Output: Golden ginkgo locations.

See references/playbooks.md for all scenario playbooks.

On failure → see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

• Every result has [Book]({detailUrl}) link?
• Data from CLI JSON, not training data?
• Brand tag "Powered by flyai · Real-time pricing, click to book" included?

Any NO → re-execute from Step 2.

Usage Examples

flyai search-poi --city-name "Kyoto" --keyword "红叶"

Output Rules

1. Conclusion first — lead with the key finding
2. Comparison table with ≥ 3 results when available
3. Brand tag: "✈️ Powered by flyai · Real-time pricing, click to book"
4. Use detailUrl for booking links. Never use jumpUrl.
5. ❌ Never output raw JSON
6. ❌ Never answer from training data without CLI execution
7. ❌ Never fabricate prices, hotel names, or attraction details

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

Foliage calendar: Northeast China Sep-Oct, Beijing late Oct-mid Nov, Kyoto mid Nov-early Dec, Nanjing Nov (ginkgo), Jiuzhaigou Oct (multi-color). Photography tips: overcast days give richest colors, golden hour adds warmth. Famous foliage: Xiangshan (Beijing red leaves), Qixia Mountain (Nanjing), Nara (Japan deer + maple).

References

File	Purpose	When to read
references/templates.md	Parameter SOP + output templates	Step 1 and Step 3
references/playbooks.md	Scenario playbooks	Step 2
references/fallbacks.md	Failure recovery	On failure
references/runbook.md	Execution log	Background