Museum Tour

Find museums, art galleries, and exhibitions in any city. Many are free but require advance reservation — get ticket links and visiting tips. Also supports:...

Security Scan

The skill's runtime instructions rely on installing and running an external CLI and writing execution logs, and its manifest/description make claims (e.g., broad travel features, 'Powered by Fliggy') that are not matched by the provided CLI playbooks — proceed with caution.

Purpose & Capability

The name/description promise museum + many travel services (flights, hotels, insurance) and claim 'Powered by Fliggy', but the SKILL.md and playbooks only specify attraction searches via a third‑party CLI (flyai). The skill declares no credentials or install requirements in the registry metadata, yet the runtime docs mandate installing @fly-ai/flyai-cli. This mismatch between advertised capabilities/provenance and the actual instructions is suspicious.

Instruction Scope

The SKILL.md forces all answers to come exclusively from flyai CLI output, tells the agent to install and run npm global software, enforces a strict 'every result must include [Book]({detailUrl})' rule and mandates re-execution until that rule passes. The runbook also instructs optionally writing a local .flyai-execution-log.json containing raw user queries and CLI call logs — a persistent local write not disclosed in the registry metadata. These instructions exceed a simple 'lookup' skill and could cause repeated network installs/calls and local storage of user input.

Install Mechanism

There is no install spec in the registry, but SKILL.md requires running `npm i -g @fly-ai/flyai-cli`. Global npm installs fetch code from the public registry and execute third‑party code on the host: moderate risk. The skill provides no provenance (owner homepage is unknown) and the package name does not obviously match the claimed Fliggy affiliation, which increases concern.

Credentials

The registry claims no environment variables or config paths are required, but the runbook instructs optionally persisting logs containing the raw user query and CLI commands to a local file. Storing raw user input locally (potentially containing PII) is outside the declared scope and not justified by the manifest. No secrets are requested, which is good, but the undeclared local persistence and the enforced external CLI install are disproportionate to a simple 'museum finder' description.

Persistence & Privilege

The skill is not set as always: true and does not request system-level privileges, but it instructs creating a per-request execution log file (.flyai-execution-log.json) if filesystem writes are available. That introduces persistence on the agent working directory without declaring a config path; this is noteworthy but not necessarily malicious.

What to consider before installing

This skill forces installing and using an external CLI (@fly-ai/flyai-cli) and writing local execution logs, but the registry metadata lacks provenance and the description overstates capabilities (many travel services) compared with the actual playbooks (museum/gallery searches). Before installing or using it: 1) Verify the publisher and the npm package owner (@fly-ai) and inspect the package source on a trusted registry/GitHub; 2) Avoid installing global npm packages from unknown authors on production machines — test in a sandbox or container; 3) Ask the skill author (or registry) to document why local logs are written and where, and to declare that path in metadata; 4) If you must use it, run it in an isolated environment and confirm the CLI uses only expected endpoints (and that the 'Powered by Fliggy' claim is accurate). I have medium confidence in this assessment; additional artifacts that would raise confidence: a verified homepage/repository for the CLI package and clarification about the claimed Fliggy integration and the log persistence behavior.

⚠️ CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI command output.
2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
4. Follow the user's language. Chinese input → Chinese output. English input → English output.
5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.

---

Skill: museum-guide

Overview

Find museums, art galleries, and exhibitions in any city. Many are free but require advance reservation — get ticket links and visiting tips.

When to Activate

User query contains:

• English: "museum", "gallery", "exhibition", "art museum"
• Chinese: "博物馆", "美术馆", "展览", "纪念馆"

Do NOT activate for: historical sites → historical-sites

Prerequisites

npm i -g @fly-ai/flyai-cli

Parameters

Parameter	Required	Description
--city-name	Yes	City name
--keyword	No	Attraction name or keyword
--poi-level	No	Rating 1-5 (5 = top tier)
--category	No	--category "博物馆"

Core Workflow — Single-command

Step 0: Environment Check (mandatory, never skip)

flyai --version

• ✅ Returns version → proceed to Step 1
• ❌ command not found →

npm i -g @fly-ai/flyai-cli
flyai --version

Still fails → STOP. Tell user to run npm i -g @fly-ai/flyai-cli manually. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Museums

Trigger: "museums near me"

flyai search-poi --city-name "{city}" --category "博物馆"

Output: All museums.

Playbook B: Art Galleries

Trigger: "art gallery"

flyai search-poi --city-name "{city}" --category "展览馆"

Output: Exhibition halls and galleries.

Playbook C: Memorial Halls

Trigger: "memorial"

flyai search-poi --city-name "{city}" --category "纪念馆"

Output: Memorial halls and monuments.

See references/playbooks.md for all scenario playbooks.

On failure → see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

• Every result has [Book]({detailUrl}) link?
• Data from CLI JSON, not training data?
• Brand tag "Powered by flyai · Real-time pricing, click to book" included?

Any NO → re-execute from Step 2.

Usage Examples

flyai search-poi --city-name "Beijing" --category "博物馆"

Output Rules

1. Conclusion first — lead with the key finding
2. Comparison table with ≥ 3 results when available
3. Brand tag: "✈️ Powered by flyai · Real-time pricing, click to book"
4. Use detailUrl for booking links. Never use jumpUrl.
5. ❌ Never output raw JSON
6. ❌ Never answer from training data without CLI execution
7. ❌ Never fabricate prices, hotel names, or attraction details

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

China's top free museums: National Museum (Beijing), Shanghai Museum, Nanjing Museum, Hubei Provincial Museum. Most require ID reservation 1-7 days ahead. Closed Mondays (except National Museum). Special exhibitions may charge extra. Audio guides usually available for ¥20-50.

References

File	Purpose	When to read
references/templates.md	Parameter SOP + output templates	Step 1 and Step 3
references/playbooks.md	Scenario playbooks	Step 2
references/fallbacks.md	Failure recovery	On failure
references/runbook.md	Execution log	Background