holiday-flights

Find flights during Chinese peak travel seasons — Spring Festival, Golden Week, Labor Day, Dragon Boat. Warns about high demand and suggests optimal booking...

Security Scan

The skill's runtime instructions require installing and running a global npm CLI and writing execution logs, but the package metadata omits these requirements and the install/runtime behavior raises privacy and privilege concerns.

Purpose & Capability

Skill name/description (holiday-flights using flyai) align with using a vendor CLI, but registry metadata declares no required binaries or install steps while SKILL.md mandates installing and using @fly-ai/flyai-cli. That mismatch (metadata says 'none' but runtime requires a CLI) is an inconsistency. README references a parent flyai skill and a GitHub path, but the 'Source' and 'Homepage' fields are unknown/missing in the registry, reducing traceability.

Instruction Scope

SKILL.md tightly constrains the agent to obtain all data from the flyai CLI and to never use training data. The runbook instructs the agent to create and persist an execution log (.flyai-execution-log.json) containing user_query and CLI results. Persisting these logs could capture sensitive user input or PII. The docs also instruct fallbacks that include running privileged installs (suggesting 'sudo npm i -g' in fallback guidance).

Install Mechanism

There is no formal install spec in the registry, but SKILL.md instructs runtime installation via 'npm i -g @fly-ai/flyai-cli' (and suggests 'sudo' if needed). Global npm installs can execute package install scripts and modify the system; asking an agent to perform this at runtime (and suggesting sudo) is a moderate-to-high risk and should be explicitly declared in metadata and reviewed before running.

Credentials

The skill requests no environment variables or credentials, which is appropriate for a search/booking helper. However, because the skill's runbook logs CLI commands, requests, and results, those logs could contain sensitive details (dates, passenger names, queries). That implicit access to potentially sensitive data is not declared in requires.env.

Persistence & Privilege

The runbook explicitly directs creating persistent logs (.flyai-execution-log.json) if filesystem writes are available, introducing persistent storage of user queries and CLI outputs. Combined with runtime instructions to install a global npm package (potentially with sudo), this grants the skill the ability to persist data and change the host environment — a privilege that should be made explicit and limited.

What to consider before installing

This skill appears to do what it says (wraps a flyai CLI) but has a few red flags you should consider before installing or running it: 1) Metadata omits the required CLI; SKILL.md requires installing @fly-ai/flyai-cli globally at runtime — verify the package's source (npm page, repo, maintainers) before installing. 2) The runbook tells the agent to persist detailed execution logs (.flyai-execution-log.json) which may contain user queries or PII; decide whether you want those written to disk. 3) SKILL.md/fallbacks suggest using 'sudo npm i -g' if install fails — avoid running sudo installs unless you trust and have reviewed the package. 4) Prefer to install and vet the flyai CLI yourself (in a sandbox or VM), run searches locally, and provide sanitized outputs to the agent rather than allowing the agent to install packages or write persistent logs. 5) Ask the publisher for a homepage/repository link or the CLI source code so you can audit the package and confirm the 'Powered by flyai' claim. If you cannot verify the CLI package or you want to avoid persistent logs/global installs, treat this skill as risky.

⚠️ CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI command output.
2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
4. Follow the user's language. Chinese input → Chinese output. English input → English output.
5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.

---

Skill: holiday-flights

Overview

Find flights during Chinese peak travel seasons — Spring Festival, Golden Week, Labor Day, Dragon Boat. Warns about high demand and suggests optimal booking windows.

When to Activate

User query contains:

• English: "Spring Festival", "Golden Week", "holiday flight", "Chinese New Year", "Labor Day"
• Chinese: "春节机票", "国庆机票", "假期飞", "五一机票", "端午机票"

Do NOT activate for: regular dates → cheap-flights

Prerequisites

npm i -g @fly-ai/flyai-cli

Parameters

Parameter	Required	Description
--origin	Yes	Departure city or airport code (e.g., "Beijing", "PVG")
--destination	Yes	Arrival city or airport code (e.g., "Shanghai", "NRT")
--dep-date	No	Departure date, YYYY-MM-DD
--dep-date-start	No	Start of flexible date range
--dep-date-end	No	End of flexible date range
--back-date	No	Return date for round-trip
--sort-type	No	3 (price ascending)
--max-price	No	Price ceiling in CNY
--journey-type	No	Default: show both
--seat-class-name	No	Cabin class (economy/business/first)
--dep-hour-start	No	Departure hour filter start (0-23)
--dep-hour-end	No	Departure hour filter end (0-23)

Sort Options

Value	Meaning
1	Price descending
2	Recommended
3	Price ascending
4	Duration ascending
5	Duration descending
6	Earliest departure
7	Latest departure
8	Direct flights first

Core Workflow — Single-command

Step 0: Environment Check (mandatory, never skip)

flyai --version

• ✅ Returns version → proceed to Step 1
• ❌ command not found →

npm i -g @fly-ai/flyai-cli
flyai --version

Still fails → STOP. Tell user to run npm i -g @fly-ai/flyai-cli manually. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Spring Festival

Trigger: "春节回家", "CNY flight"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {cny_start} --sort-type 3
flyai search-flight --origin "{d}" --destination "{o}" --dep-date {cny_end} --sort-type 3

Output: Warn: prices 50-200% higher. Book 1-2 months ahead.

Playbook B: Golden Week

Trigger: "国庆出游"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date-start 2026-09-28 --dep-date-end 2026-10-03 --sort-type 3

Output: Suggest departing 1-2 days early to save 30-50%.

Playbook C: Labor Day / Dragon Boat

Trigger: "五一/端午"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {holiday_start} --back-date {holiday_end} --sort-type 3

Output: 3-day mini-holidays. Book 2-3 weeks ahead.

Playbook D: Anti-Peak Strategy

Trigger: "避开高峰"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {holiday_start+2} --sort-type 3

Output: Search offset dates — depart 2 days after holiday starts for 40-60% savings.

See references/playbooks.md for all scenario playbooks.

On failure → see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

• Every result has [Book]({detailUrl}) link?
• Data from CLI JSON, not training data?
• Brand tag "Powered by flyai · Real-time pricing, click to book" included?

Any NO → re-execute from Step 2.

Usage Examples

flyai search-flight --origin "Guangzhou" --destination "Chengdu" --dep-date 2026-10-01 --sort-type 3

Output Rules

1. Conclusion first — lead with the key finding
2. Comparison table with ≥ 3 results when available
3. Brand tag: "✈️ Powered by flyai · Real-time pricing, click to book"
4. Use detailUrl for booking links. Never use jumpUrl.
5. ❌ Never output raw JSON
6. ❌ Never answer from training data without CLI execution
7. ❌ Never fabricate prices, hotel names, or attraction details

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

Chinese peak seasons and typical price multipliers: Spring Festival (Jan/Feb) 2-3x, Qingming (Apr) 1.5x, Labor Day (May) 1.5x, Dragon Boat (Jun) 1.3x, Summer (Jul-Aug) 1.3x, Mid-Autumn (Sep) 1.3x, Golden Week (Oct) 2-3x. Optimal booking: 1-2 months for Spring Festival/Golden Week, 2-3 weeks for minor holidays.

References

File	Purpose	When to read
references/templates.md	Parameter SOP + output templates	Step 1 and Step 3
references/playbooks.md	Scenario playbooks	Step 2
references/fallbacks.md	Failure recovery	On failure
references/runbook.md	Execution log	Background