Variflight Global Flight Fares

Variflight Global Flight Fares searches one-way flight fares from the Variflight ticket API by departure IATA city code, arrival IATA city code, and departur...

Security Scan

The skill is internally consistent: it bundles a small Python script that calls Variflight's public ticket API and the SKILL.md instructions match the included code and required runtime, with no unexpected credentials or external endpoints.

Purpose & Capability

Name/description, SKILL.md, and the included script all focus on querying Variflight's ticket API for one-way fares by dep/arr/date. The required binary (python3) is appropriate and no unrelated services, credentials, or paths are requested.

Instruction Scope

Runtime instructions restrict actions to collecting dep/arr/date, validating inputs, and running the bundled script. They explicitly forbid requesting an API key and only direct network calls to the Variflight endpoint present in the script. The script does not read other files or environment variables.

Install Mechanism

There is no install spec (instruction-only skill) and the included script is a small, readable Python file. Nothing is downloaded from untrusted URLs and no archives are extracted.

Credentials

The skill requests no environment variables or credentials. The script issues outbound requests to ticket.variflight.com only and does not access unrelated secrets or config paths.

Persistence & Privilege

always is false and the skill does not request persistent system-level changes. It only contains a script that will run when invoked; it does not modify other skills or agent configuration.

Assessment

This skill is coherent and appears to do what it claims: run a bundled Python script that queries Variflight's public ticket API. Before installing, confirm you trust the Variflight domain because the script will make outbound network requests there. No credentials are requested and the script does not exfiltrate other data, but it will run code locally under the agent using python3—review the script yourself if you require extra assurance. If you have strict network or privacy policies, consider restricting outbound access or running the script in a controlled environment.

Overview

Use the bundled script to query the Variflight ticket API and return one-way flight options for a single route and date.

Workflow

1. Collect dep, arr, and date.
2. Validate dep and arr as three-letter IATA city codes and date as YYYY-MM-DD.
3. If the user gives city names instead of codes, infer only when the mapping is unambiguous; otherwise ask for the IATA codes.
4. Run python3 scripts/query_flights.py --dep BJS --arr SHA --date 2026-04-21.
5. Summarize the result with departure airport, arrival airport, times, duration, price, transfer info, and the flight tag text.

Output Rules

• Treat API code != 0 as a failure and surface the returned msg.
• Treat an empty data.list as a valid "no flights found" result.
• Use --limit N when the user only wants a subset of results.
• Use --json only when the user asks for raw payload data.
• Mention transfer flights separately from direct flights when summarizing.
• Do not ask the user to provide an API key for this skill.

Script

• scripts/query_flights.py accepts:
  • --dep
  • --arr
  • --date
  • --limit
  • --json
• The script sends the fixed request parameter flightNum=10.

Example

Run python3 scripts/query_flights.py --dep BJS --arr SHA --date 2026-04-21 --limit 5 to fetch the first five displayed results for Beijing to Shanghai on April 21, 2026.