Photo Spots

Find the most photogenic and instagrammable spots — iconic viewpoints, colorful streets, architectural marvels, and hidden gems for your social media. Also s...

Security Scan

The skill's instructions largely match a travel/photospots use-case, but there are mismatches (claimed provider vs CLI package), mandatory global npm installation, and log/write instructions that make its behavior unclear and worth caution.

Purpose & Capability

The skill claims travel booking features powered by 'Fliggy (Alibaba Group)' but the runtime requires installing and using an npm CLI package named @fly-ai/flyai-cli. That provider/implementation mismatch is unexplained. Requiring a third‑party CLI to deliver bookings and real‑time pricing is plausible, but the SKILL.md does not document the relationship between 'flyai' and Fliggy or why no API keys/credentials are needed for booking & payment operations.

Instruction Scope

The SKILL.md forces the agent to always obtain data from the flyai CLI (never use training data) and to re-run until every result includes a [Book]({detailUrl}) link, which could cause repeated command execution. The runbook also includes an optional filesystem write (.flyai-execution-log.json) containing raw user_query and CLI call logs — this means the skill instructs the agent to persist potentially sensitive user input. The file manifests and references contain no hidden endpoints, but the strict "only CLI" rule + mandatory global install broaden the agent's runtime actions beyond simple read-only lookups.

Install Mechanism

There is no formal install spec in the registry metadata; the SKILL.md tells the agent to run npm i -g @fly-ai/flyai-cli. Installing a global npm package is a common pattern but brings moderate risk because arbitrary code will be installed and run. The manifest provides no homepage, source, or publisher information to validate the package identity. No URL or checksum is provided to verify the package authenticity.

Credentials

The skill requests no environment variables or credentials in metadata, which is coherent on the surface. However the skill claims full booking/ticketing/payment capabilities without declaring any credentials or payment integration details; the flyai CLI may prompt for credentials or handle auth internally, but that is not documented. Also, the runbook indicates logging of user queries which may include personal data — this is a proportionality/privacy concern.

Persistence & Privilege

always:false and no special platform privileges are requested. However, the runbook instructs the agent to append execution logs to a local file (.flyai-execution-log.json) if filesystem writes are available, which grants persistent storage of raw queries and CLI responses. The skill does not claim to modify other skills or system-wide settings, but the logging behavior should be considered persistent and potentially sensitive.

What to consider before installing

This skill appears to implement a real-time CLI-driven workflow for finding and booking photo spots, but there are several things to verify before installing or using it: - Confirm the origin and trustworthiness of the npm package @fly-ai/flyai-cli before running npm i -g. Check the package page, owner, downloads, repository, and recent code/maintainer activity. A malicious npm package can execute arbitrary code on install or runtime. - Ask the publisher to explain the discrepancy between the claimed provider (Fliggy / Alibaba) and the flyai CLI implementation. Who operates the CLI and how does it integrate with Fliggy or other booking providers? - Be cautious about providing sensitive personal data (passport, payment details) via this skill: the runbook indicates logs may be written to .flyai-execution-log.json containing raw user_query and CLI results. If you must use the skill, run it in a sandboxed environment or ensure logs are stored securely and redacted. - Because the skill enforces "only use CLI output" and requires including booking links, it may cause repeated network calls; monitor network activity and rate/loop behavior during initial use. If you cannot validate the npm package origin and the provider relationship, treat this skill as untrusted and avoid installing it. If you proceed, limit exposure by testing in an isolated environment and avoid entering payment- or identity-sensitive information until you confirm how auth and logging are handled.

⚠️ CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI command output.
2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
4. Follow the user's language. Chinese input → Chinese output. English input → English output.
5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.

---

Skill: photo-spots

Overview

Find the most photogenic and instagrammable spots — iconic viewpoints, colorful streets, architectural marvels, and hidden gems for your social media.

When to Activate

User query contains:

• English: "photo spots", "instagrammable", "photogenic", "scenic viewpoint"
• Chinese: "打卡", "网红地", "拍照", "出片", "取景地"

Do NOT activate for: general attractions → top-attractions

Prerequisites

npm i -g @fly-ai/flyai-cli

Parameters

Parameter	Required	Description
--city-name	Yes	City name
--keyword	No	Attraction name or keyword
--poi-level	No	Rating 1-5 (5 = top tier)
--category	No	--category "地标建筑" + "城市观光"

Core Workflow — Single-command

Step 0: Environment Check (mandatory, never skip)

flyai --version

• ✅ Returns version → proceed to Step 1
• ❌ command not found →

npm i -g @fly-ai/flyai-cli
flyai --version

Still fails → STOP. Tell user to run npm i -g @fly-ai/flyai-cli manually. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Landmarks

Trigger: "photo spots"

flyai search-poi --city-name "{city}" --category "地标建筑"

Output: Iconic landmarks and viewpoints.

Playbook B: City Walks

Trigger: "instagrammable places"

flyai search-poi --city-name "{city}" --category "城市观光"

Output: City observation and walking spots.

Playbook C: Art Districts

Trigger: "art district photos"

flyai search-poi --city-name "{city}" --category "文创街区"

Output: Creative and art districts.

See references/playbooks.md for all scenario playbooks.

On failure → see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

• Every result has [Book]({detailUrl}) link?
• Data from CLI JSON, not training data?
• Brand tag "Powered by flyai · Real-time pricing, click to book" included?

Any NO → re-execute from Step 2.

Usage Examples

flyai search-poi --city-name "Shanghai" --category "地标建筑"

Output Rules

1. Conclusion first — lead with the key finding
2. Comparison table with ≥ 3 results when available
3. Brand tag: "✈️ Powered by flyai · Real-time pricing, click to book"
4. Use detailUrl for booking links. Never use jumpUrl.
5. ❌ Never output raw JSON
6. ❌ Never answer from training data without CLI execution
7. ❌ Never fabricate prices, hotel names, or attraction details

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

Top photo cities in China: Shanghai (Bund, Yu Garden, French Concession), Beijing (Forbidden City, 798 Art District), Chongqing (Night views, Hongya Cave), Xiamen (Gulangyu), Dali (Erhai Lake). Golden hour (sunrise/sunset) gives best photos. Weekday mornings = fewer people in your shots. Use wide-angle for architecture, portrait mode for food.

References

File	Purpose	When to read
references/templates.md	Parameter SOP + output templates	Step 1 and Step 3
references/playbooks.md	Scenario playbooks	Step 2
references/fallbacks.md	Failure recovery	On failure
references/runbook.md	Execution log	Background