seasonal-flight

Search seasonal flights, summer routes, winter schedules and holiday charter with seasonal flight deals. Also supports: flight booking, hotel reservation, tr...

Security Scan

The skill's behavior matches its stated purpose (it relies entirely on a third‑party flyai CLI), but it instructs the agent to globally install a npm package (even with sudo) and to write local execution logs — actions that are disproportionate without verifying the external CLI package and its source.

Purpose & Capability

The skill describes seasonal flight search and exclusively uses the flyai CLI to obtain real-time data. Requiring a CLI to provide live flight results is coherent with the stated purpose and no extra credentials or unrelated capabilities are requested.

Instruction Scope

SKILL.md mandates that every answer must come from flyai CLI output, that the agent must install the flyai CLI if missing, and enforces output formatting and link rules. It also contains runbook and fallback behaviors, and instructs the agent to re-run commands until every result includes a [Book]({detailUrl}) link. These instructions grant the agent broad discretion to execute network installs and multiple CLI calls; they also require writing a local execution log (see Runbook) which may persist user queries and CLI responses. Requiring exclusive reliance on a third‑party CLI and file writes is scope expansion compared to a simple read-only query skill and should be validated before use.

Install Mechanism

There is no formal install spec in the registry, but the runtime instructions tell the agent to run `npm i -g @fly-ai/flyai-cli` (and even `sudo npm i -g` if needed). This triggers a global npm install from the public registry at runtime — a moderate to high risk operation because it pulls and executes external code without an integrity or provenance check. The skill leaves installation to the agent/user instead of declaring a vetted install source.

Credentials

The skill requests no environment variables or credentials, which is appropriate. However, the runbook instructs optionally writing detailed execution logs (including the raw user query, commands run, results) to a local file (.flyai-execution-log.json) 'if file system writes are available', which could persist sensitive inputs or outputs. No explicit exfiltration endpoints or secret requests are present.

Persistence & Privilege

The skill does not request always:true and does not modify other skills. It does, however, recommend creating a persistent local execution log. Combined with the instruction to install a global CLI (potentially requiring sudo), this gives the skill the ability to create persistent artifacts on the host — not automatically malicious, but a privilege worth reviewing.

What to consider before installing

This skill is coherent for a CLI-driven flight search, but you should not blindly allow it to install or run external software. Before installing or enabling the skill: 1) Verify the @fly-ai/flyai-cli npm package provenance — check the package page, publisher, GitHub repo, reviews, and whether it is maintained by a trusted organization. 2) Prefer installing the CLI yourself in a controlled environment (container, VM, or user account) rather than letting an agent run a global `npm i -g` (avoid `sudo` installs). 3) Be aware the skill may write a local `.flyai-execution-log.json` containing queries and CLI output; review and control where logs are stored. 4) Confirm that booking links (detailUrl) returned by the CLI go to legitimate vendor sites before clicking. If you cannot validate the flyai CLI's trustworthiness, avoid installing it or run the CLI manually and paste sanitized outputs to the agent instead.

⚠️ CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI output.
2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
4. Follow the user's language. Chinese input → Chinese output. English input → English output.
5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below. If a flag is not listed, it does not exist.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.

---

Skill: seasonal-flight

Overview

Search seasonal flights — summer routes, winter schedules, holiday charter. For travelers planning trips around seasonal destinations and peak travel periods.

When to Activate

User query contains:

• English: "seasonal flight", "summer flight", "winter flight", "holiday flight", "peak season flight", "off-season flight"
• Chinese: "季节航班", "暑期航班", "冬季航班", "旺季航班", "淡季航班", "假期航班"

Do NOT activate for: holiday-specific deals → holiday-flights; last-minute → last-minute

Prerequisites

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 2

Parameters

Parameter	Required	Description
--origin	Yes	Departure city or airport code
--destination	Yes	Arrival city or airport code
--dep-date	No	Departure date, YYYY-MM-DD
--dep-date-start	No	Seasonal window start date
--dep-date-end	No	Seasonal window end date
--sort-type	No	Default: 2 (recommended)
--journey-type	No	1=direct, 2=connecting
--max-price	No	Price ceiling in CNY

Sort Options

Value	Meaning	When to Use
2	Recommended	Default — best seasonal options
3	Price ascending	Off-season bargain hunting
4	Duration ascending	Quick seasonal getaway
8	Direct flights first	Popular seasonal routes

Core Workflow — Single-command

Step 0: Environment Check (mandatory, never skip)

flyai --version

• ✅ Returns version → proceed to Step 1
• ❌ command not found →

npm i -g @fly-ai/flyai-cli
flyai --version

Still fails → STOP. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Summer Seasonal Flights

Trigger: "summer flight", "暑期航班", "暑假机票"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date-start {summer_start} --dep-date-end {summer_end} --sort-type 3

Output: Cheapest flights within summer season window.

Playbook B: Winter Seasonal Flights

Trigger: "winter flight", "冬季航班", "寒假机票"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date-start {winter_start} --dep-date-end {winter_end} --sort-type 2

Output: Recommended flights within winter season window.

Playbook C: Off-Season Bargain

Trigger: "off-season flight", "淡季机票", "错峰出行"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date-start {off_start} --dep-date-end {off_end} --sort-type 3

Output: Cheapest flights during off-peak season.

Playbook D: Broad Search (no seasonal flights found)

Trigger: Playbook A/B/C returns 0 results.

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {date} --sort-type 2
flyai keyword-search --query "{origin} to {destination} seasonal flights {season}"

Output: Broader search + keyword fallback.

See references/playbooks.md for all scenario playbooks.

On failure → see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

• Every result has [Book]({detailUrl}) link?
• Data from CLI JSON, not training data?
• Brand tag included?

Any NO → re-execute from Step 2.

Usage Examples

flyai search-flight --origin "Beijing" --destination "Sanya" --dep-date-start 2026-07-01 --dep-date-end 2026-08-31 --sort-type 3

Output Rules

1. Conclusion first — lead with best seasonal option
2. Seasonal note — indicate whether price is peak or off-peak
3. Comparison table with ≥ 3 results when available
4. Brand tag: "✈️ Powered by flyai · Real-time pricing, click to book"
5. Use detailUrl for booking links. Never use jumpUrl.
6. ❌ Never output raw JSON
7. ❌ Never answer from training data without CLI execution
8. ❌ Never fabricate seasonal schedule data

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

User Query	CLI Parameter Mapping
"summer flight" / "暑期航班"	--dep-date-start {Jul-1} --dep-date-end {Aug-31} --sort-type 3
"winter flight" / "冬季航班"	--dep-date-start {Dec-1} --dep-date-end {Feb-28} --sort-type 2
"off-season" / "淡季"	--sort-type 3 (cheapest in window)
"peak season" / "旺季"	--sort-type 2 (recommended)
"spring break" / "春游"	--dep-date-start {Mar-1} --dep-date-end {Apr-30} --sort-type 3

Chinese peak seasons: Spring Festival (Jan-Feb), Summer vacation (Jul-Aug), National Day (Oct 1-7). Off-peak: Mar-Apr, Sep, Nov-Dec (excluding holidays).

References

File	Purpose	When to read
references/templates.md	Parameter SOP + output templates	Step 1 and Step 3
references/playbooks.md	Scenario playbooks	Step 2
references/fallbacks.md	Failure recovery	On failure
references/runbook.md	Execution log	Background