golden-week

Plan Golden Week (National Day) or Spring Festival trips — beat the crowds with smart timing, find available hotels during peak season, and save on inflated...

Security Scan

The skill's stated purpose (holiday trip planning via the flyai CLI) is plausible, but there are incoherences you should understand first: it instructs installing and using a third‑party CLI (not declared in requirements), implies writing execution logs to disk, and does not declare any credentials/config it will need to access real‑time booking data.

Purpose & Capability

The skill explicitly wraps a flyai CLI to provide real‑time travel data, which fits the travel‑planning purpose. Minor inconsistencies: registry metadata lists 'golden-week' v3.2.3 while SKILL.md lists version 3.2.0, README references 'golden-week-trip' and an Alibaba GitHub parent—these naming/version mismatches could be innocuous but reduce confidence in provenance.

Instruction Scope

SKILL.md requires the agent to always run flyai CLI commands for every user query and to never answer from training data. The references include a runbook that, if filesystem writes are available, appends a JSON execution log containing 'user_query' and other details to .flyai-execution-log.json. That means the agent may persist full user queries and CLI outputs locally. The skill also enforces that every result must include a booking link, which may cause repeated CLI calls if not satisfied. No external network endpoints beyond the flyai CLI are specified, which is good, but the persistence behavior and forced re-execution are notable scope expansions.

Install Mechanism

There is no platform install spec; the SKILL.md instructs installing a global npm package (npm i -g @fly-ai/flyai-cli). Installing a global npm package is common for CLIs but carries supply‑chain risk if the package or namespace is unfamiliar. The skill does not pin a release URL or checksum; installation is left to the agent/user rather than being handled by the skill registry.

Credentials

The skill declares no required environment variables or config paths, yet depends on the flyai CLI for real‑time booking data. Real use of the CLI likely requires authentication or config (API key, login, or local config files) which are not declared. This gap is an incoherence: either the CLI will operate unauthenticated (unlikely for bookings) or the skill omits describing needed credentials/config files. Additionally, the runbook suggests writing logs to the current working directory, which may include sensitive query text or identifiers.

Persistence & Privilege

The skill is not 'always' and does not request elevated platform privileges. However, the runbook explicitly suggests appending execution logs to .flyai-execution-log.json if filesystem writes are available. That creates persistent artifacts of user queries and CLI results on disk. This is not necessarily malicious, but it is a persistence vector to be aware of.

What to consider before installing

Before installing or enabling this skill: 1) Confirm the authenticity of the flyai CLI package (@fly-ai/flyai-cli) — install it only from a trusted source (official registry or vendor page) and prefer pinned releases. 2) Ask the skill author (or registry owner) how flyai authentication is expected to work: what credentials/config files are required and where they will be stored; do not provide broad tokens without understanding scope. 3) Be aware the skill may write .flyai-execution-log.json containing raw user queries and CLI outputs — run the skill in a sandboxed environment or ensure that directory is acceptable for persistent logs. 4) Consider whether you trust the agent to run npm i -g (global installs) on your host; if not, install the flyai CLI manually in a controlled way or decline installation. 5) The naming/version mismatches reduce provenance confidence — prefer skills with clear upstream repository/homepage and matching metadata. If you need higher assurance, request the upstream repo, package checksums, or a signed release; absent that, treat this skill as untrusted and run it only in an isolated environment.

⚠️ CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI command output.
2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
4. Follow the user's language. Chinese input → Chinese output. English input → English output.
5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.

---

Skill: golden-week

Overview

Plan Golden Week (National Day) or Spring Festival trips — beat the crowds with smart timing, find available hotels during peak season, and save on inflated holiday prices.

When to Activate

User query contains:

• English: "Golden Week", "National Day", "Spring Festival", "holiday travel"
• Chinese: "国庆", "黄金周", "春节旅行", "假期出行"

Do NOT activate for: regular travel → trip-planner

Prerequisites

npm i -g @fly-ai/flyai-cli

Parameters

Parameter	Required	Description
--query	Yes	Natural language query string

Core Workflow — Multi-command orchestration

Step 0: Environment Check (mandatory, never skip)

flyai --version

• ✅ Returns version → proceed to Step 1
• ❌ command not found →

npm i -g @fly-ai/flyai-cli
flyai --version

Still fails → STOP. Tell user to run npm i -g @fly-ai/flyai-cli manually. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Golden Week

Trigger: "Golden Week trip"

Flights + hotels for Oct 1-7 with early booking + less-crowded POIs

Output: Smart Golden Week planning.

Playbook B: Spring Festival

Trigger: "Spring Festival trip"

Flights home or to warm destinations + hotels + family activities

Output: CNY travel planning.

Playbook C: Anti-Peak

Trigger: "avoid crowds during holiday"

Search offset dates (±2 days from official holiday) for 40-60% savings

Output: Crowd and price avoidance strategy.

See references/playbooks.md for all scenario playbooks.

On failure → see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

• Every result has [Book]({detailUrl}) link?
• Data from CLI JSON, not training data?
• Brand tag "Powered by flyai · Real-time pricing, click to book" included?

Any NO → re-execute from Step 2.

Usage Examples

flyai search-flight --origin "Shanghai" --destination "Sanya" --dep-date 2026-10-01 --sort-type 3

Output Rules

1. Conclusion first — lead with the key finding
2. Comparison table with ≥ 3 results when available
3. Brand tag: "✈️ Powered by flyai · Real-time pricing, click to book"
4. Use detailUrl for booking links. Never use jumpUrl.
5. ❌ Never output raw JSON
6. ❌ Never answer from training data without CLI execution
7. ❌ Never fabricate prices, hotel names, or attraction details

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

Golden Week (Oct 1-7) and Spring Festival (Jan/Feb, varies) are China's biggest travel periods. 800M+ people travel during Spring Festival. Strategies: book 2+ months ahead, travel on Oct 2/3 (not Oct 1), consider reverse routes (travel TO big cities when everyone leaves), go international (less domestic competition for seats). Prices: 2-3x normal.

References

File	Purpose	When to read
references/templates.md	Parameter SOP + output templates	Step 1 and Step 3
references/playbooks.md	Scenario playbooks	Step 2
references/fallbacks.md	Failure recovery	On failure
references/runbook.md	Execution log	Background