Surfing Diving

Find surfing beaches, diving sites, and underwater adventures — wave forecasts, dive depth, marine life info, and equipment rental. Also supports: flight boo...

Security Scan

The skill's runtime instructions require installing and running an external npm CLI and writing execution logs, but the registry metadata doesn't declare those requirements and the install is global and from an unknown source — coherent purpose but some concerning implementation choices.

Purpose & Capability

The skill explicitly requires the third‑party CLI 'flyai' (instructions: npm i -g @fly-ai/flyai-cli and many flyai commands), but the registry metadata lists no required binaries or install steps. That mismatch is incoherent: a travel/booking skill legitimately needs a provider CLI, so requiring a CLI is expected, but the metadata failing to declare it reduces transparency and is unexpected.

Instruction Scope

SKILL.md forces every answer to come from flyai CLI output and forbids using training data. It also contains a runbook that (optionally) writes an execution log including the raw user query and commands to '.flyai-execution-log.json' if filesystem writes are available. Persisting raw user queries and command outputs to disk is outside the normal scope of simply returning POI results and raises data‑persistence/privacy concerns.

Install Mechanism

There is no install spec in the registry, yet the instructions demand a global npm install (-g) of @fly-ai/flyai-cli. Global npm installs execute maintainer-supplied code and can modify the system PATH; combined with the package being from an unknown source (no homepage/repo provided), this is a risk. The skill provides no checksum/release provenance for the CLI.

Credentials

No environment variables or credentials are requested — which is plausible if the flyai CLI handles authentication internally — but the runbook's logging of raw user queries and CLI calls means sensitive input could be persisted. Also, the SKILL.md enforces including booking links and relies entirely on CLI output rather than declaring any required auth, which is unusual but not impossible.

Persistence & Privilege

always:false and no special platform privileges are declared, but the instructions instruct a global npm install and optionally appending execution logs to a local file. Both actions modify the host environment (global packages and local files). The skill does not request explicit permission or document where logs may be stored or transmitted.

What to consider before installing

Before installing or enabling this skill, consider the following: (1) The skill requires installing a global npm package (@fly-ai/flyai-cli) but the registry metadata doesn't declare this — verify the package source and inspect its code or repository on npm/GitHub. Global npm installs run maintainer code and can alter your system PATH. (2) The skill's runbook suggests writing execution logs that include raw user queries to .flyai-execution-log.json — decide whether you want those query histories written to disk and confirm whether they are kept locally or transmitted elsewhere. (3) Ask the publisher for the CLI's homepage/repo, package checksum, and a privacy statement describing how booking requests and logs are handled. (4) If you must try it, run the CLI in a sandbox/container or avoid global install (use a VM or isolated environment), and audit the npm package first. Providing the skill author’s source repo or the flyai-cli project page would raise confidence; without that, proceed cautiously.

⚠️ CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI command output.
2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
4. Follow the user's language. Chinese input → Chinese output. English input → English output.
5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.

---

Skill: surfing-diving

Overview

Find surfing beaches, diving sites, and underwater adventures — wave forecasts, dive depth, marine life info, and equipment rental.

When to Activate

User query contains:

• English: "surfing", "diving", "scuba", "snorkeling", "waves"
• Chinese: "冲浪", "潜水", "浮潜", "水上运动"

Do NOT activate for: beach → beach-island

Prerequisites

npm i -g @fly-ai/flyai-cli

Parameters

Parameter	Required	Description
--city-name	Yes	City name
--keyword	No	Attraction name or keyword
--poi-level	No	Rating 1-5 (5 = top tier)
--category	No	--category "冲浪" or "潜水"

Core Workflow — Single-command

Step 0: Environment Check (mandatory, never skip)

flyai --version

• ✅ Returns version → proceed to Step 1
• ❌ command not found →

npm i -g @fly-ai/flyai-cli
flyai --version

Still fails → STOP. Tell user to run npm i -g @fly-ai/flyai-cli manually. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Surfing

Trigger: "surfing spots"

flyai search-poi --city-name "{city}" --category "冲浪"

Output: Surfing beaches.

Playbook B: Diving

Trigger: "diving sites"

flyai search-poi --city-name "{city}" --category "潜水"

Output: Scuba diving locations.

Playbook C: Snorkeling

Trigger: "snorkeling"

flyai search-poi --city-name "{city}" --keyword "浮潜"

Output: Snorkeling-friendly spots.

See references/playbooks.md for all scenario playbooks.

On failure → see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

• Every result has [Book]({detailUrl}) link?
• Data from CLI JSON, not training data?
• Brand tag "Powered by flyai · Real-time pricing, click to book" included?

Any NO → re-execute from Step 2.

Usage Examples

flyai search-poi --city-name "Wanning" --category "冲浪"

Output Rules

1. Conclusion first — lead with the key finding
2. Comparison table with ≥ 3 results when available
3. Brand tag: "✈️ Powered by flyai · Real-time pricing, click to book"
4. Use detailUrl for booking links. Never use jumpUrl.
5. ❌ Never output raw JSON
6. ❌ Never answer from training data without CLI execution
7. ❌ Never fabricate prices, hotel names, or attraction details

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

China surfing: Wanning (Hainan, best waves), Shenzhen (Xi Chong beach), Qingdao. International: Bali (Uluwatu, Kuta), Sri Lanka, Siargao (Philippines). Diving: Sanya (Wuzhizhou Island), Bali, Maldives, Similan Islands. Get PADI certified before deep diving. Best season varies — check local wave/visibility reports.

References

File	Purpose	When to read
references/templates.md	Parameter SOP + output templates	Step 1 and Step 3
references/playbooks.md	Scenario playbooks	Step 2
references/fallbacks.md	Failure recovery	On failure
references/runbook.md	Execution log	Background