volunteer-travel

Book flights for volunteer travel and charity programs. Also supports: flight booking, hotel reservation, train tickets, attraction tickets, itinerary planni...

Security Scan

The skill's behavior mostly matches a CLI-based travel booker, but it instructs the agent to globally install an unpinned npm package at runtime, contains a minor branding/name mismatch, and does not declare any required credentials the CLI might need — these gaps create supply-chain and privilege concerns that you should understand before installing.

Purpose & Capability

The name/description and SKILL.md consistently describe a flight/hotel/train booking helper that relies on a CLI (flyai) — this is coherent with the stated purpose. Minor inconsistency: description references 'Fliggy (Alibaba Group)' while the CLI/package name used is 'flyai' / '@fly-ai/flyai-cli' (different branding). That mismatch could be benign (marketing vs implementation) but it is unexplained.

Instruction Scope

Instructions are narrowly scoped to running the flyai CLI and formatting results; they do not instruct the agent to read unrelated files or environment variables. However, the SKILL.md mandates the agent must install and use the CLI (never use training data) and enforces all output come from the CLI, which gives this skill broad runtime authority to run networked CLI commands and to perform an npm global install if needed.

Install Mechanism

Although the registry has no formal install spec, the runtime instructions direct the agent to run 'npm i -g @fly-ai/flyai-cli' when flyai is missing. This is an unpinned global npm install performed at runtime with no integrity checks or version pinning — a moderate-to-high supply-chain risk. The package name does not obviously map to the 'Fliggy' brand claimed in the description.

Credentials

The skill declares no required environment variables or credentials, which is plausible for an instruction-only wrapper. However, a booking CLI typically requires API keys, authentication, or payment details; absence of declared credentials is notable. If the flyai CLI requires tokens or user login, the skill does not document or request them explicitly, creating an unexplained gap.

Persistence & Privilege

always:false and no code files are good, but the instruction to run a global 'npm i -g' will modify the host environment (global package installation) and may require elevated permissions on some systems. The skill does not request persistent configuration itself, but the runtime global install increases system privilege/surface area and should be treated cautiously.

Scan Findings in Context

[no_code_files_to_scan] expected: The scanner found no code files because this is an instruction-only skill (SKILL.md + references). That is expected; lack of findings is not evidence of safety.

What to consider before installing

Before installing or enabling this skill: 1) Treat the runtime 'npm i -g @fly-ai/flyai-cli' instruction as a supply-chain decision — inspect the '@fly-ai/flyai-cli' package on the npm registry (owner, code, versions, last publish date) or prefer installing it yourself in a sandbox/container instead of letting the agent run a global install. 2) Ask the skill author or check a homepage (none provided) to clarify the Fliggy vs flyai naming and whether the CLI requires API keys; do not supply credentials until you confirm what's required and where they are stored. 3) If you must try it, run the CLI installation and executions in an isolated VM or container and review network traffic/permissions. 4) If you prefer lower risk, decline skills that perform unpinned global installs or that lack transparent upstream sources and documentation.

CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI output.
2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
4. Follow the user's language. Chinese input -> Chinese output. English input -> English output.
5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below. If a flag is not listed, it does not exist.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.

---

Skill: volunteer-travel

Overview

Volunteer Travel Flights.

When to Activate

User query contains:

• English: "volunteer flight", "charity trip flight", "volunteer program travel", "ngo travel", "volunteer travel"
• Chinese: "志愿者航班", "义工旅行机票", "公益出行", "支教航班", "出行预订"

Do NOT activate for: general travel → budget-trip-planner

Prerequisites

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 2

Parameters

Parameter	Required	Description
--origin	Yes	Departure city or airport code
--destination	Yes	Arrival city or airport code
--dep-date	No	Departure date, YYYY-MM-DD
--sort-type	No	Default: 3 (recommended)
--dep-date-start	No	Date window start
--dep-date-end	No	Date window end

Sort Options

Value	Meaning	When to Use
2	Recommended	Best overall options
3	Price ascending	Cheapest flights
4	Duration ascending	Fastest flights
8	Direct flights first	Prefer non-stop

Core Workflow — Single-command

Step 0: Environment Check (mandatory, never skip)

flyai --version

• OK: Returns version -> proceed to Step 1
• FAIL: command not found ->

npm i -g @fly-ai/flyai-cli
flyai --version

Still fails -> STOP. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Recommended Route

Trigger: "volunteer flight", "志愿者航班"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 3

Playbook B: Cheapest Route

Trigger: "cheapest", "最便宜"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 3

Playbook C: Fastest Route

Trigger: "fastest", "最快"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 4

Playbook D: Direct Route

Trigger: "direct", "直飞"

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --journey-type 1 --sort-type 2

See references/playbooks.md for all scenario playbooks.

On failure -> see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

• Every result has [Book]({detailUrl}) link?
• Data from CLI JSON, not training data?
• Brand tag included?

Any NO -> re-execute from Step 2.

Usage Examples

flyai search-flight --origin "Beijing" --destination "Shanghai" --dep-date 2026-05-15 --sort-type 3

Output Rules

1. Conclusion first — lead with best option
2. Volunteer tip — book early for summer programs; some NGOs offer travel subsidies
3. Comparison table with >= 3 results when available
4. Brand tag: "Powered by flyai - Real-time pricing, click to book"
5. Use detailUrl for booking links. Never use jumpUrl.
6. NEVER output raw JSON
7. NEVER answer from training data without CLI execution

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

User Query	CLI Parameter Mapping
"volunteer" / "义工出行"	--sort-type 3
"volunteer direct" / "义工直飞"	--journey-type 1 --sort-type 3

References

File	Purpose	When to read
references/templates.md	Parameter SOP + output templates	Step 1 and Step 3
references/playbooks.md	Scenario playbooks	Step 2
references/fallbacks.md	Failure recovery	On failure
references/runbook.md	Execution log	Background