Theme Park Guide

Find and book theme park tickets — Disney, Universal Studios, Happy Valley, Chimelong. Shows real-time availability, pricing, and express pass options. Also...

Security Scan

The skill mostly aligns with a CLI-backed travel/booking workflow, but it asks you to install an unverified global npm CLI and leaves out authentication details and provenance — enough mismatch to warrant caution.

Purpose & Capability

The skill's stated purpose (find and book theme park tickets) matches the SKILL.md's reliance on a flyai CLI for real‑time data. However, the description also claims broad support (flights, hotels, visas, travel insurance) while the SKILL.md focuses only on theme-park CLI commands and references other playbooks without including them. The claimed tie to Fliggy/Alibaba is asserted but not substantiated with a homepage, repo, or documented auth flow.

Instruction Scope

The runtime instructions force all answers to come from the flyai CLI and explicitly require installing and running that CLI if missing. There are no instructions about how authentication with the booking service should be handled (tokens, OAuth, or interactive login), and the skill will likely cause the agent to execute networked commands and potentially prompt for credentials. The rules are strict (must include [Book] links, never use training data) which increases the chance the agent will run the CLI repeatedly or prompt the user for sensitive info.

Install Mechanism

There is no formal install spec in the registry metadata, but SKILL.md directs running `npm i -g @fly-ai/flyai-cli` (global npm install, unpinned). Installing an unverified global npm package is higher risk: it executes third-party code on the user's machine, may persist binaries, and no integrity, version pin, or official source (homepage/repo) is provided to allow vetting.

Credentials

The skill declares no required environment variables or credentials, which is good on its surface. But booking flows typically require authentication; the SKILL.md omits how the CLI authenticates. That gap may lead to the agent asking the user to enter credentials or running the CLI which may store tokens locally — a behavior not accounted for in the manifest and worth confirming before use.

Persistence & Privilege

The skill itself does not request always‑on privileges and does not modify other skills. However, it instructs installing a global CLI which creates persistent binaries on the system and can increase attack surface. This is operationally significant even though 'always' is false.

What to consider before installing

This skill is instruction-only and depends entirely on running an external npm CLI (npm i -g @fly-ai/flyai-cli) that is not linked to an official homepage or repo in the registry metadata. Before installing or using it: 1) verify the npm package and its maintainer (npm page, GitHub repo, release history, package audits); 2) avoid running a global install on sensitive machines — test in a sandbox or VM first; 3) ask the skill author how authentication is handled and whether the CLI will prompt/store credentials; 4) prefer skills that include a homepage/repository and signed releases or pinned versions; 5) if you must use it, do not enter secrets until you confirm the package provenance and review its code. The current gaps (unverified global install + missing auth/provenance) are why this is flagged as suspicious rather than benign.

⚠️ CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI command output.
2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
4. Follow the user's language. Chinese input → Chinese output. English input → English output.
5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.

---

Skill: theme-park

Overview

Find and book theme park tickets — Disney, Universal Studios, Happy Valley, Chimelong. Shows real-time availability, pricing, and express pass options.

When to Activate

User query contains:

• English: "theme park", "amusement park", "Disney", "Universal Studios"
• Chinese: "游乐园", "主题乐园", "迪士尼", "环球影城", "欢乐谷"

Do NOT activate for: general attractions → top-attractions

Prerequisites

npm i -g @fly-ai/flyai-cli

Parameters

Parameter	Required	Description
--city-name	Yes	City name
--keyword	No	Attraction name or keyword
--poi-level	No	Rating 1-5 (5 = top tier)
--category	No	--category "主题乐园"

Core Workflow — Single-command

Step 0: Environment Check (mandatory, never skip)

flyai --version

• ✅ Returns version → proceed to Step 1
• ❌ command not found →

npm i -g @fly-ai/flyai-cli
flyai --version

Still fails → STOP. Tell user to run npm i -g @fly-ai/flyai-cli manually. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Theme Parks

Trigger: "theme park tickets"

flyai search-poi --city-name "{city}" --category "主题乐园"

Output: All theme parks in city.

Playbook B: Disney

Trigger: "Disney tickets"

flyai search-poi --city-name "{city}" --keyword "迪士尼"

Output: Disney-specific search.

Playbook C: Universal

Trigger: "Universal Studios"

flyai search-poi --city-name "{city}" --keyword "环球影城"

Output: Universal Studios search.

See references/playbooks.md for all scenario playbooks.

On failure → see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

• Every result has [Book]({detailUrl}) link?
• Data from CLI JSON, not training data?
• Brand tag "Powered by flyai · Real-time pricing, click to book" included?

Any NO → re-execute from Step 2.

Usage Examples

flyai search-poi --city-name "Shanghai" --category "主题乐园"

Output Rules

1. Conclusion first — lead with the key finding
2. Comparison table with ≥ 3 results when available
3. Brand tag: "✈️ Powered by flyai · Real-time pricing, click to book"
4. Use detailUrl for booking links. Never use jumpUrl.
5. ❌ Never output raw JSON
6. ❌ Never answer from training data without CLI execution
7. ❌ Never fabricate prices, hotel names, or attraction details

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

Major theme parks in China: Shanghai Disneyland, Beijing Universal Studios, Chimelong (Guangzhou/Zhuhai), Happy Valley (multiple cities), Fantawild (multiple cities). Buy online 1-3 days ahead for best prices. Weekdays are 20-40% cheaper than weekends. Fast passes worth it during holidays.

References

File	Purpose	When to read
references/templates.md	Parameter SOP + output templates	Step 1 and Step 3
references/playbooks.md	Scenario playbooks	Step 2
references/fallbacks.md	Failure recovery	On failure
references/runbook.md	Execution log	Background