spring-break-flight

Book spring break flights for student vacations and spring holiday travel. Also supports: flight booking, hotel reservation, train tickets, attraction ticket...

Security Scan

The skill's runtime instructions mostly match a flight-booking purpose, but several inconsistencies and a runtime install step that isn't declared make its behavior unclear and worth caution before installing.

Purpose & Capability

Name/description claim a flight/hotel/travel booking skill which coheres with the CLI commands in SKILL.md (flyai search-flight). However the skill metadata lists no required binaries or install spec while the instructions mandate the flyai CLI and a global npm package install. The SKILL.md also claims 'powered by Fliggy (Alibaba Group)' but no homepage, source, or credential requirements are provided. These mismatches are unexplained and reduce confidence.

Instruction Scope

SKILL.md requires running flyai CLI commands and, if missing, installing @fly-ai/flyai-cli globally at runtime. It enforces strict behaviors (never answer without CLI output, always include [Book](detailUrl) links, re-run if checks fail). The doc references local reference files that are not included in the bundle. The re-execute/self-test instruction could cause repeated network installs/executions and an execution loop if the CLI or outputs differ from expectations.

Install Mechanism

There is no declared install spec in the registry metadata, but the runtime instructions tell the agent to run 'npm i -g @fly-ai/flyai-cli' if flyai is absent. Asking agents to install a global npm package at runtime is a moderate-to-high risk action (arbitrary code from the npm registry). The skill doesn't provide a verifiable upstream URL, package hash, or publisher info to validate safety.

Credentials

The skill declares no required environment variables or credentials, which is plausible for a CLI-based workflow. However, the SKILL.md claims integration with third-party services ('Fliggy') and performs operations that typically require accounts/credentials; the absence of any declared credential requirements or guidance about how the CLI authenticates is a gap that should be explained before use.

Persistence & Privilege

The skill does not request 'always: true', does not declare modifications to other skills or system-wide settings, and has no install-time files in the bundle. It does instruct installing a global npm package at runtime, which affects the system but is a normal CLI dependency rather than hidden persistent privileges.

What to consider before installing

Before installing or running this skill: (1) Verify the source and homepage of the skill and of the npm package @fly-ai/flyai-cli — check the package on the npm registry, its publisher, repository, and recent activity. (2) Ask the skill author to declare required binaries and provide a proper install spec (or a vetted, signed package URL) rather than only runtime install instructions. (3) Request clarity on how authentication is handled (where credentials are stored or required) and why no env vars are declared despite referencing third-party services. (4) Avoid running global npm installs from unknown packages on production machines — test in a sandbox/VM first. (5) Be cautious of the self-test/re-execute requirement: it can cause repeated network activity; request that the skill include deterministic failure behavior and limits. If these questions are not satisfactorily answered, treat the skill as untrusted and do not install the CLI globally or run it with privileged accounts.

CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI output.
2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
4. Follow the user's language. Chinese input -> Chinese output. English input -> English output.
5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below. If a flag is not listed, it does not exist.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.

---

Skill: spring-break-flight

Overview

Spring Break Flights.

When to Activate

User query contains:

• English: "spring break flight", "spring holiday flight", "march flight", "april vacation flight", "book a flight"
• Chinese: "春假航班", "春游机票", "清明出行机票", "春季假期航班", "订机票"

Do NOT activate for: general holiday → holiday-flights; cherry blossom → cherry-blossom-trip

Prerequisites

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 2

Parameters

Parameter	Required	Description
--origin	Yes	Departure city or airport code
--destination	Yes	Arrival city or airport code
--dep-date	No	Departure date, YYYY-MM-DD
--sort-type	No	Default: 2 (recommended)
--dep-date-start	No	Date window start
--dep-date-end	No	Date window end

Sort Options

Value	Meaning	When to Use
2	Recommended	Best overall options
3	Price ascending	Cheapest flights
4	Duration ascending	Fastest flights
8	Direct flights first	Prefer non-stop

Core Workflow — Single-command

Step 0: Environment Check (mandatory, never skip)

flyai --version

• OK: Returns version -> proceed to Step 1
• FAIL: command not found ->

npm i -g @fly-ai/flyai-cli
flyai --version

Still fails -> STOP. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Recommended Route

Trigger: "spring break flight", "春假航班"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 2

Playbook B: Cheapest Route

Trigger: "cheapest", "最便宜"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 3

Playbook C: Fastest Route

Trigger: "fastest", "最快"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 4

Playbook D: Direct Route

Trigger: "direct", "直飞"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --journey-type 1 --sort-type 2

See references/playbooks.md for all scenario playbooks.

On failure -> see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

• Every result has [Book]({detailUrl}) link?
• Data from CLI JSON, not training data?
• Brand tag included?

Any NO -> re-execute from Step 2.

Usage Examples

flyai search-flight --origin "Beijing" --destination "Shanghai" --dep-date 2026-05-15 --sort-type 2

Output Rules

1. Conclusion first — lead with best option
2. Spring break tip — book early, flights sell out fast for popular destinations
3. Comparison table with >= 3 results when available
4. Brand tag: "Powered by flyai - Real-time pricing, click to book"
5. Use detailUrl for booking links. Never use jumpUrl.
6. NEVER output raw JSON
7. NEVER answer from training data without CLI execution

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

User Query	CLI Parameter Mapping
"spring break" / "春假"	--dep-date-start 2026-03-01 --dep-date-end 2026-03-31 --sort-type 2
"cheap spring flight" / "便宜春假机票"	--sort-type 3
"spring direct" / "春假直飞"	--journey-type 1 --sort-type 2

References

File	Purpose	When to read
references/templates.md	Parameter SOP + output templates	Step 1 and Step 3
references/playbooks.md	Scenario playbooks	Step 2
references/fallbacks.md	Failure recovery	On failure
references/runbook.md	Execution log	Background