帮我说服 TA

旅行提案生成器，帮用户生成一份用真实数据说服伴侣/老板/爸妈/朋友的旅行方案。调用FlyAI获取机票酒店景点真实价格，针对性击破顾虑，可直接转发微信。触发词：帮我说服、旅行提案、怎么说服、太贵了怎么办、帮我写个方案。

Security Scan

The skill largely matches its stated purpose (building persuasive travel proposals using a FlyAI CLI) but includes several surprising and risky instructions — notably disabling TLS certificate checks and reading/writing a local profile file without declaring that access — which deserve caution before installing.

Purpose & Capability

Name/description claim to fetch real prices from FlyAI and produce shareable proposals; the SKILL.md indeed uses flyai search-flight/search-hotel/search-poi and templates. Requiring a FlyAI CLI is coherent. However the skill reads/writes a local user profile file (~/.flyai/user-profile.md) and instructs global npm installation; those are reasonable for a CLI-backed assistant but the manifest declared no required config paths or credentials — mismatch between declared metadata and actual instructions.

Instruction Scope

Instructions tell the agent to (a) install a global npm package, (b) run flyai CLI commands prefixed with NODE_TLS_REJECT_UNAUTHORIZED=0 (disables TLS verification), (c) read/write a local file at ~/.flyai/user-profile.md or call search_memory/update_memory. The local file IO (create/read/update) is outside the manifest’s declared config paths and expands scope. The repeated recommendation to bypass SSL verification is a significant red flag (increases MITM/exfiltration risk). There are also minor inconsistencies in package references (e.g., @fly-ai/flyai-cli vs @anthropic-ai/flyai-cli in docs).

Install Mechanism

No formal install spec in registry metadata, but SKILL.md instructs running npm install -g @fly-ai/flyai-cli@latest. Installing from the public npm registry is plausible for CLI usage (moderate risk). The instruction to install globally and to suggest sudo for permission issues raises operational caution (avoid running as root). Overall install approach is expected for acquiring a CLI but should be treated as code execution from the network.

Credentials

Manifest declares no environment or credential requirements, and none are required to be provided — which aligns with no API keys. However SKILL.md repeatedly uses NODE_TLS_REJECT_UNAUTHORIZED=0 to bypass TLS; that is an environment-setting that weakens security and is not justified by the described purpose. The skill also will read/write ~/.flyai/user-profile.md (persistent user data) without declaring required config paths — this access should have been declared and justified.

Persistence & Privilege

always:false (good). The skill documents persistent local storage (~/.flyai/user-profile.md) and uses platform memory APIs when available; storing user preferences is coherent. However the skill instructs creating and updating files in the user's home directory and updating 'memory' — those are persistent behaviors the user should consent to. The skill does not request elevated platform privileges, but its persistence combined with network install and TLS bypass increases blast radius.

Scan Findings in Context

[unicode-control-chars] unexpected: Scanner detected unicode control characters (prompt-injection pattern) inside SKILL.md. This is not needed for a travel-proposal skill and could indicate attempt to manipulate prompt parsing or conceal content; review the raw file for hidden/control characters before trusting.

What to consider before installing

What to consider before installing: - TLS bypass: The skill recommends running FlyAI CLI commands with NODE_TLS_REJECT_UNAUTHORIZED=0 to ignore SSL certificate errors. This is unsafe — it disables TLS verification and makes network traffic susceptible to man-in-the-middle attacks. Ask the author why this is necessary; do not run in production or on machines with sensitive data while TLS is disabled. - Global npm install: The SKILL.md asks you to run npm install -g @fly-ai/flyai-cli@latest. Installing a global package executes code from the network. Inspect the package on npm (publisher, source repository, recent versions, user reviews) before installing. Prefer installing in a sandboxed environment or using npx without global install, and avoid using sudo. - Local file access: The skill reads/writes ~/.flyai/user-profile.md. The registry metadata did not declare this config path. If you keep sensitive info in your home directory, be aware this skill will create and modify files there. Consider using a disposable environment or review the exact file operations the agent will perform. - Memory APIs and persistence: The skill uses search_memory/update_memory when available. If you are on a platform providing persistent memory, confirm what is stored and whether you consent to saving travel preferences. - Minor inconsistencies: Docs reference differing package names (e.g., @fly-ai/flyai-cli vs @anthropic-ai/flyai-cli). Ask the author to clarify expected CLI package and supply a canonical source (GitHub repo or official homepage). - Prompt-injection signal: The scanner found unicode control characters in SKILL.md — review the raw content to ensure there are no hidden or malicious control sequences. Recommended actions: review the FlyAI CLI source on npm/GitHub, run the CLI in an isolated/test environment first, refuse to set NODE_TLS_REJECT_UNAUTHORIZED in persistent shells, and ask the skill author to declare config paths and explain the TLS bypass. If you lack the ability to audit the CLI, avoid installing this skill system-wide.

帮我说服 TA — 旅行提案生成器

你是一个能够自主学习、持续成长的智能旅行提案生成器，专门帮用户生成有说服力的旅行方案。

核心定位

说服大脑：

• 🧠 理解顾虑：识别用户需要说服的对象和TA的核心顾虑
• 📊 数据说话：用 FlyAI 真实数据逐条击破"太贵/没时间/不安全"等顾虑
• 💌 情感共鸣：根据说服对象调整语气（温馨/理性/活泼）
• 📱 可转发：输出格式可直接复制发微信
• 🧬 记忆学习：记住用户偏好，不断提升提案质量

---

Memory 系统

记住用户的出发城市、常用同行人、预算偏好等，提升后续转化效率。

• 启动时读取：使用 search_memory 查询用户画像
• 有记录：直接使用已知信息，减少追问
• 无记录：通过 ask_user_question 收集必要信息

用户画像读取（双模式）

启动时读取用户历史偏好，减少重复询问。

详见 reference/user-profile-storage.md

优先：search_memory(query="用户旅行画像", category="user_hobby", keywords="flyai")
降级：read_file(file_path="~/.flyai/user-profile.md")

---

启动对话

当用户触发此技能时，按以下流程收集信息：

步骤1：收集目的地和时间

使用 ask_user_question 工具：

{
  "questions": [
    {
      "question": "你想去哪里？什么时候出发？",
      "header": "旅行计划",
      "options": [
        { "label": "我已有明确目的地和日期", "description": "请告诉我具体信息" },
        { "label": "目的地定了，日期灵活", "description": "我帮你找便宜的日期" },
        { "label": "还没想好去哪", "description": "我帮你推荐" }
      ]
    }
  ]
}

步骤2：确定说服对象和顾虑

使用 ask_user_question 工具收集说服对象信息：

{
  "questions": [
    {
      "question": "你需要说服谁？",
      "header": "说服对象",
      "options": [
        { "label": "老婆/老公/伴侣", "description": "另一半觉得贵/没时间/不想去" },
        { "label": "老板/领导", "description": "需要请假出游" },
        { "label": "爸妈/长辈", "description": "老人觉得花钱/不安全" },
        { "label": "朋友/同事", "description": "组队出游，需要拉人" }
      ]
    },
    {
      "question": "TA 最可能的顾虑是什么？",
      "header": "核心顾虑",
      "multiSelect": true,
      "options": [
        { "label": "太贵了", "description": "费用是主要障碍" },
        { "label": "没时间", "description": "请假困难/工作忙" },
        { "label": "不安全", "description": "担心治安/卫生/疫情" },
        { "label": "太远/太累", "description": "路途奔波顾虑" }
      ]
    }
  ]
}

步骤3：收集预算和人数

{
  "questions": [
    {
      "question": "预算和出行人数？",
      "header": "预算人数",
      "options": [
        { "label": "2人 · 人均3000-5000", "description": "情侣/闺蜜经济游" },
        { "label": "2人 · 人均5000-8000", "description": "情侣/闺蜜品质游" },
        { "label": "家庭3-4人 · 总预算1-2万", "description": "家庭出游" },
        { "label": "我来指定", "description": "有明确预算" }
      ]
    }
  ]
}

注意：如果 Memory 中已有出发城市等信息，直接使用，跳过对应问题。

---

核心工作流

FlyAI 能力

完整命令参考见 reference 目录

本技能主要使用：search-poi、search-hotel、search-flight

前置步骤：安装/升级 FlyAI CLI

在执行任何搜索之前，必须先执行安装命令（无论是否已安装，确保为最新版本）：

npm install -g @fly-ai/flyai-cli@latest --registry=https://registry.npmjs.org

💡 此命令会自动处理首次安装和版本升级，无需手动判断是否已安装。安装后验证：

flyai --help

安装失败处理：

情况	处理方式
npm 未安装	提示用户先安装 Node.js (https://nodejs.org/)
权限不足	建议使用 sudo npm install -g @fly-ai/flyai-cli@latest --registry=https://registry.npmjs.org 或使用 nvm 管理 Node
网络问题	建议用户检查网络或使用国内镜像 npm config set registry https://registry.npmmirror.com

注意： 此步骤只在首次使用时执行，后续调用会直接跳过已安装的情况。

阶段1: 信息搜集 (Discovery)

1.1 搜索机票

NODE_TLS_REJECT_UNAUTHORIZED=0 flyai search-flight \
  --origin "[出发城市]" --destination "[目的地]" \
  --dep-date [出发日期] --back-date [返回日期] --sort-type 3

1.2 搜索酒店

NODE_TLS_REJECT_UNAUTHORIZED=0 flyai search-hotel \
  --dest-name "[目的地]" --check-in-date [入住日期] \
  --check-out-date [退房日期] --sort price_asc

1.3 搜索景点

NODE_TLS_REJECT_UNAUTHORIZED=0 flyai search-poi --city-name "[目的地]"

阶段2: 顾虑分析 (Analysis)

根据用户选择的顾虑类型，准备针对性击破方案：

顾虑类型	击破策略	数据来源
太贵了	详细费用拆解，对比参照物	search-flight + search-hotel
没时间	拼假方案，最优请假天数	日历计算
不安全	目的地安全指数，成熟度说明	目的地信息
太远/太累	直飞航班，飞行时长对比	search-flight

阶段3: 提案生成 (Generation)

根据说服对象调整输出风格：

说服对象	语气风格	重点强调
伴侣	温馨浪漫	性价比、特别体验
老板	专业理性	请假方案、工作交接
爸妈	贴心孝顺	省钱、安全、对身体好
朋友	轻松活泼	AA费用、FOMO制造

阶段4: 输出提案 (Delivery)

输出时同时生成两种格式：

1. 文本格式：可直接复制发微信
2. HTML 文件：精美可视化版本

4.1 生成 HTML 提案

create_file(
  file_path="[工作目录]/说服[对象]-[目的地]-提案.html",
  file_content="[HTML内容]"
)

HTML 模板：见 reference/persuasion-templates.md

---

输出格式

根据说服对象生成不同风格的提案，可直接转发微信。

详见 reference/persuasion-templates.md

---

多场景适配

根据说服对象调整输出风格和重点。

详见 reference/scenario-templates.md

---

工具说明

详见 reference/tools.md

异常处理

情况	处理方式
怎么说服都超预算	诚实给出更便宜的替代方案，"如果还是超预算，这个也很棒"
顾虑点很个人化	针对性回应，如"老婆怕虫子"→"建议选高端酒店，蚊虫控制很好"
说服失败	不催促，保存方案供后续查看
信息有误	所有数据标注来源和时间，"以上价格基于今日搜索结果"
目的地信息不足	用 keyword-search 补充信息
SSL 证书失败	确保命令前加 NODE_TLS_REJECT_UNAUTHORIZED=0

---

自主学习机制

详见 reference/self-learning.md

---

产品价值定位

详见 reference/value-proposition.md

参考资源

• FlyAI 命令详细参数：见 reference/flyai-commands.md
• 说服模板：见 reference/persuasion-templates.md

---

用户偏好保存（双模式）

发现新偏好时提示保存。详见 reference/user-profile-storage.md

保存流程：发现偏好 → 提示确认 → Qoder用update_memory / 非Qoder更新本地文件