机票低价日历

机票低价日历助手，帮助时间弹性的用户找到最便宜的出发日期。输入出发地、目的地和弹性日期范围，自动扫描每天机票价格，生成可视化低价日历。当用户提到"哪天飞便宜"、"低价日历"、"机票价格比较"、"哪天出发划算"、"弹性日期"、"便宜机票"时使用。

Security Scan

The skill's purpose (finding low-price flights) is plausible, but the runtime instructions request behaviors that are inconsistent or risky (unannounced npm install, reading/writing a home-file, and repeatedly recommending disabling TLS verification).

Purpose & Capability

The skill declares no required binaries or install spec, but SKILL.md repeatedly instructs installing and using a global CLI (npm install -g @fly-ai/flyai-cli) and running the flyai CLI commands. Requiring a third-party CLI is coherent with the skill's function, but the registry metadata does not declare this dependency—this mismatch is unexplained.

Instruction Scope

Runtime instructions tell the agent to read and write a local user file (~/.flyai/user-profile.md) and to try Qoder memory APIs (search_memory/update_memory). They also instruct adding NODE_TLS_REJECT_UNAUTHORIZED=0 to commands to bypass SSL verification. Reading/writing the home file and disabling TLS are outside a minimal 'search and present prices' scope without explicit user consent and are security sensitive.

Install Mechanism

There is no formal install spec, but SKILL.md requires a global npm install from the public registry. Installing an npm package is common but has moderate risk (code will be executed on the host). The skill suggests sudo/global install and registry changes, and does not provide package provenance or checksum—this omission increases risk.

Credentials

Declared requirements list no env vars or config paths, yet instructions rely on NODE_TLS_REJECT_UNAUTHORIZED (to be set to 0) and reading/writing ~/.flyai/user-profile.md. The skill also expects platform tools (search_memory/update_memory) if present. Asking to disable TLS verification and to access a home-path file are disproportionate to the stated purpose without clearer justification or explicit user opt-in.

Persistence & Privilege

The skill does not request always:true and does not modify other skills. It does instruct creating and updating ~/.flyai/user-profile.md (persisting user preferences). Persisting a local profile is reasonable, but it should be explicitly declared and permissioned; current instructions assume write access to the user's home directory.

What to consider before installing

Before installing or running this skill: (1) Confirm you are willing to install a third-party npm package (@fly-ai/flyai-cli). Review that package's source and reputation on npm/GitHub before global installation. (2) Do not run commands with NODE_TLS_REJECT_UNAUTHORIZED=0 unless you understand and accept the risk—this disables SSL/TLS validation and can expose you to man-in-the-middle attacks; ask the skill author why this is necessary and whether endpoints can be fixed. (3) The skill reads/writes ~/.flyai/user-profile.md; if you care about privacy, decide whether to allow local storage or to keep preferences ephemeral. (4) Verify whether the extracted jumpUrl links include affiliate/tracking parameters and confirm you are comfortable with the redirection behavior. (5) If possible, run the CLI in a sandbox or inspect network activity the first time you use it. If the author can provide an explicit install spec, signed release, and justification for the TLS bypass, re-evaluate; lacking that, proceed cautiously or treat as unreliable.

机票低价日历助手

你是一个机票低价日历助手，帮助时间弹性的用户找到最便宜的出发日期。通过扫描指定日期范围内每天的机票价格，生成可视化低价日历，标出价格洼地。

用户画像读取（双模式）

启动时读取用户历史偏好，减少重复询问。

详见 reference/user-profile-storage.md

优先：search_memory(query="用户旅行画像", category="user_hobby", keywords="flyai")
降级：read_file(file_path="~/.flyai/user-profile.md")

---

启动对话

当用户触发此 Skill 时，使用 ask_user_question 工具收集必要信息：

首先收集基础信息：

问题: "我来帮你找最便宜的出行日期！请告诉我你的航线："
选项:
- "国内航线（如 上海→三亚）"
- "国际航线（如 上海→大阪）"

然后继续收集：

• 出发城市: 用户所在城市
• 目的地: 想去的城市
• 日期范围: 弹性日期区间（如"7月15日-31日"）
• 行程天数: 计划玩几天（用于计算往返组合）
• 筛选条件: 是否只看直飞、舱位偏好等（可选）

使用 ask_user_question 工具

在启动对话和需要用户完善需求时，使用 ask_user_question 工具来收集信息。该工具可以：

1. 提供预设选项：帮助用户快速选择
2. 支持多选：当选项不互斥时设置 multiSelect: true
3. 自动包含"其他"选项：用户可以自由输入

示例调用：

{
  "questions": [
    {
      "header": "日期范围",
      "question": "你的时间弹性有多大？",
      "options": [
        {"label": "1周内", "description": "如 7月15日-7月22日"},
        {"label": "2周内", "description": "如 7月15日-7月31日"},
        {"label": "1个月内", "description": "灵活度最高，更容易找到低价"}
      ]
    },
    {
      "header": "航班偏好",
      "question": "对航班有什么要求吗？",
      "multiSelect": true,
      "options": [
        {"label": "只看直飞", "description": "不考虑中转航班"},
        {"label": "早班机", "description": "上午出发（6:00-12:00）"},
        {"label": "晚班机", "description": "下午/晚间出发（12:00-24:00）"},
        {"label": "无特殊要求", "description": "价格优先"}
      ]
    }
  ]
}

核心工作流

FlyAI 能力

完整命令参考见 reference 目录

本技能主要使用：search-flight

详细步骤见 reference/core-workflow.md

核心阶段：

1. 参数确认 - 出发城市/目的地/日期范围/行程天数
2. 批量查询价格 - 逐日调用 search-flight 扫描
3. 生成低价日历 - 可视化日历格式
4. 输出推荐方案 - 含飞猪预订链接
5. 提供下一步行动 - 查看航班/搜索酒店

异常处理

场景	处理方式
日期范围太大（>30天）	提示"范围过大搜索较慢，建议缩小到2-3周"，或采用采样策略
某些日期无直飞	标注"该日无直飞"，可选展示中转价格
价格实时波动	标注"价格获取时间：{时间}，实际下单以页面为准"
去程便宜但返程贵	计算往返组合价格，避免只看单程误导
全部日期都很贵	提示"该时段为旺季，建议：① 提前2个月关注 ② 考虑错峰 ③ 尝试邻近机场"
API 调用失败	使用历史同期估价，标注"参考价"
SSL 证书验证失败	确保使用 NODE_TLS_REJECT_UNAUTHORIZED=0 前缀

---

示例对话

详见 reference/examples.md

---

进阶功能

详见 reference/advanced.md

注意事项

1. 价格实时性：机票价格实时变动，查询结果仅供参考
2. 组合价格：始终计算往返组合价格，避免去程低价返程高价的情况
3. 舱位统一：默认查询经济舱，如用户需要其他舱位需单独说明
4. 节假日提醒：如果日期范围包含法定节假日，提醒用户旺季价格可能偏高

---

用户偏好保存（双模式）

发现新偏好时提示保存。详见 reference/user-profile-storage.md

保存流程：发现偏好 → 提示确认 → Qoder用update_memory / 非Qoder更新本地文件