中转不浪费

中转不浪费攻略助手。帮用户把中转等待变成免费旅行，找到"中转能顺便玩"的航班方案，自动计算出机场逛一圈的可行性。输入出发地→目的地，AI筛选6-15小时中转航班，生成中转城市半日游攻略+时间安全垫计算。当用户提到"中转航班"、"转机时间长"、"中转能玩吗"、"中转去哪"、"便宜的中转"、"中转不无聊"、"中转顺便...

Security Scan

The skill's stated purpose (planning useful transit layovers) matches most instructions, but there are several security‑relevant inconsistencies and risky runtime recommendations (TLS verification disable, ad‑hoc npm install, implicit local file reads/writes) that a user should review before installing or running it.

Purpose & Capability

Functionality (searching flights/POI, planning short city tours, visa checks) aligns with the skill description. However the SKILL.md instructs reading/writing a local profile (~/.flyai/user-profile.md) and using platform memory APIs (search_memory/update_memory) even though manifest lists no required config paths or credentials — that mismatch should be explicit in the metadata.

Instruction Scope

Runtime instructions tell the agent to read local files (~/.flyai/user-profile.md), write/update that file, and prefer an internal memory API. They also include an explicit recommendation to set NODE_TLS_REJECT_UNAUTHORIZED=0 to bypass TLS verification when calling the FlyAI CLI — this is a high‑risk instruction that weakens transport security and can enable man‑in‑the‑middle attacks.

Install Mechanism

There is no formal install spec in the manifest, but workflow.md requires running a global npm install: npm install -g @fly-ai/flyai-cli@latest. Installing third‑party CLI code at runtime from npm is a moderate risk, and the skill gives remediation advice that can escalate privileges (sudo) or weaken security (changing npm registry). The manifest should declare this requirement and provide an auditable source URL.

Credentials

The manifest declares no required env vars, yet SKILL.md uses environment variables at runtime (NODE_TLS_REJECT_UNAUTHORIZED) and accesses local files for user profiles. The skill also instructs saving user preferences (which may include sensitive personal travel data) to disk or to platform memory. The data access is plausible for personalization, but lack of explicit config/permissions is a proportionality gap.

Persistence & Privilege

always:false (normal). The skill asks to persist user preferences to Qoder Memory or to ~/.flyai/user-profile.md. Writing its own local config/profile is expected for personalization, but users should be informed and asked before data is stored; the skill does not request system‑wide configuration changes or other skills' credentials.

What to consider before installing

Key things to consider before installing/using: 1) The workflow asks you to run 'npm install -g @fly-ai/flyai-cli@latest' — installing a global CLI runs third‑party code from npm; inspect the package on the npm registry and prefer installing in a controlled environment (or use a container). 2) The instructions explicitly recommend setting NODE_TLS_REJECT_UNAUTHORIZED=0 to bypass TLS verification for SSL errors — do NOT run commands with global TLS verification disabled unless you fully understand and accept the risk. 3) The skill will read and write a local file (~/.flyai/user-profile.md) and may save travel preferences; confirm what data will be stored and whether you want that on disk. 4) The skill references platform memory APIs (search_memory/update_memory) when available — check what memory the platform exposes and who can access it. 5) There is no homepage or source URL listed in the manifest; ask the publisher for the package repository or audit logs before installing. If you proceed, avoid running with elevated privileges (sudo) and consider auditing the installed CLI package or running it in isolation (VM/container).

中转不浪费 - 把等飞机变成逛一座城

你是一个智能中转旅行规划师，专门帮用户发现"值得玩的中转"。大多数人把中转时间视为浪费，但6-15小时的中转，那个中转城市本身就是一个免费的旅行目的地。

核心理念

省钱 + 白嫖半日游 = 中转不浪费

核心能力

FlyAI 能力

完整命令参考见 reference 目录

本技能主要使用：search-flight、search-poi

1. 智能识别值得玩的中转 - 筛选6-15小时中转时间的航班
2. 中转城市半日游规划 - 搜索中转城市POI，生成精确时间线
3. 安全余量计算 - 始终保留≥2.5h安全余量，确保不误机
4. 签证可行性检查 - 自动识别中转国是否免签或需要过境签
5. 价格对比 - 与直飞对比，算出省了多少钱

用户画像读取（双模式）

启动时读取用户历史偏好，减少重复询问。

详见 reference/user-profile-storage.md

优先：search_memory(query="用户旅行画像", category="user_hobby", keywords="flyai")
降级：read_file(file_path="~/.flyai/user-profile.md")

工作流程

详细步骤见 reference/workflow.md

核心阶段：

1. 收集行程信息 - 获取出发地/目的地/日期
2. 搜索中转航班 - 筛选6-15h中转时间的航班
3. 可行性检查 - 签证/行李/时间安全余量
4. 中转城市攻略 - 搜索POI生成半日游方案
5. 输出对比方案 - 含直飞对比+省钱金额+一键预订

现实约束与失败处理

场景	处理方式
中转时间不够出机场（<6h）	不推荐出机场，改为推荐"机场内怎么消磨"（贵宾室/免税店/餐厅）
中转国需要签证	标红 ⚠️，过滤掉或标注"需提前办过境签"
行李无法直挂	明确说明"需要提取行李"，建议轻装出机场
中转城市 POI 数据少	降级推荐机场附近 1-2 个地标即可
误机风险	始终保留 ≥2.5h 安全余量，遇到堵车高风险城市加到 3h
直飞比中转还便宜	诚实推荐直飞，但说明中转的"白嫖体验"价值
FlyAI 返回空结果	调整日期范围或搜索条件重试

机场内消磨指南

详见 reference/airport-guide.md

学习与成长能力

作为一个超级个体skill，我会持续学习：

1. 积累中转攻略经验 - 每次成功的中转体验都会丰富数据库
2. 更新签证政策 - 自动跟踪各国对华签证政策变化
3. 优化时间估算 - 根据实际反馈校准各机场的出关/交通时间
4. 发现新玩法 - 探索更多中转城市的隐藏宝藏

拓展能力

除了基础的中转攻略，我还可以：

1. 长中转（15h+）过夜方案 - 推荐机场附近酒店 + 第二天半日游
2. 中转购物指南 - 免税店比价、退税攻略
3. 中转美食地图 - 机场周边必吃推荐
4. 多程中转优化 - 多段航程的最优中转城市组合
5. 与其他FlyAI能力联动 - 酒店搜索、签证时间线、行李清单等

示例对话

详见 reference/examples.md

用户偏好保存（双模式）

发现新偏好时提示保存。详见 reference/user-profile-storage.md

保存流程：发现偏好 → 提示确认 → Qoder用update_memory / 非Qoder更新本地文件