wedding-flight

Book wedding and honeymoon flights with flexible date ranges and seat class options. Also supports: flight booking, hotel reservation, train tickets, attract...

Security Scan

The skill mostly behaves like a flight-search wrapper around a CLI, but there are several inconsistencies and provenance/installation concerns you should understand before installing or running it.

Purpose & Capability

The description claims broad travel capabilities and says 'powered by Fliggy (Alibaba Group)', but the instructions only reference a third-party CLI package (flyai / @fly-ai/flyai-cli) and only provide flight-search commands. There is a mismatch between claimed provider (Fliggy) and the actual tool (flyai), and the skill advertises hotels/trains/booking yet contains no commands or parameters for those features.

Instruction Scope

SKILL.md forces the agent to always run the flyai CLI and to never answer from its training data; it mandates global npm installation if the CLI is missing. It also requires every output include a [Book]({detailUrl}) link and forbids using training data — rules that push the agent to install and rely on a specific third-party tool for every query. While the commands themselves are narrowly scoped to flight search, the instructions give the agent permission to install software globally and to retry/fallback behavior without clearer sandboxing or provenance checks.

Install Mechanism

The skill has no formal install spec in the registry but instructs runtime installation via `npm i -g @fly-ai/flyai-cli`. Installing an unverified global npm package at runtime is a moderate-to-high risk (arbitrary code execution, privilege escalation). No repository/official source, checksum, or vendor verification is provided. The package name is not a known trusted vendor and the skill's metadata lacks a homepage or source link.

Credentials

The skill does not request environment variables, credentials, or config paths; its runtime behavior appears limited to invoking the flyai CLI and formatting output. No declared secret access is required.

Persistence & Privilege

The skill is not always-enabled (always: false) and does not request system-wide configuration changes in the files provided. Autonomous invocation is allowed (platform default); there is no evidence it modifies other skills or agent configs.

What to consider before installing

What to consider before installing or running this skill: - Provenance: The skill claims 'powered by Fliggy (Alibaba Group)' but actually instructs installation and use of an npm package @fly-ai/flyai-cli. Ask the author to clarify the relationship and provide links to the official CLI repository, vendor documentation, and the npm package page. Do not install global npm packages from unknown sources on production systems. - Installation risk: The SKILL.md tells the agent to run `npm i -g @fly-ai/flyai-cli` if the CLI is missing. Global npm install runs code from the public registry and can execute arbitrary install scripts. If you must test, do so in an isolated sandbox or container and inspect the package source (or require a verified release URL / checksum). - Capability mismatch: The description advertises hotels, trains, and booking actions, but the documentation only shows flight search commands (no hotel/train/booking endpoints). If you need those features, request concrete CLI commands or an API specification. Also verify that the CLI actually returns the required {detailUrl} field used for [Book] links. - Data handling & safety: The skill demands real-time CLI data and forbids fallback to model knowledge. That means if the CLI is unavailable the skill will try to install or fail; consider whether you want the agent to perform runtime installs on your machine. - Minimal safe checks to perform before using: verify the npm package source, review its code, confirm it returns detailUrl fields for booking, and confirm there is a legitimate business relationship with Fliggy if that branding is important. If the developer can't supply provenance or source code, treat the runtime npm install as a red flag and avoid running it on sensitive systems. If the author provides a stable install spec (trusted URL, GitHub repo, signed release) and clarifies the Fliggy vs flyai discrepancy and the missing hotel/train/booking commands, this assessment could be upgraded.

⚠️ CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI output.
2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
4. Follow the user's language. Chinese input → Chinese output. English input → English output.
5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below. If a flag is not listed, it does not exist.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.

---

Skill: wedding-flight

Overview

Wedding and honeymoon flights — ceremony travel, guest flights, honeymoon getaways. For couples planning wedding-related travel.

When to Activate

User query contains:

• English: "wedding flight", "honeymoon flight", "wedding travel", "ceremony flight", "bridal trip"
• Chinese: "婚礼航班", "蜜月机票", "婚庆出行", "结婚旅行", "蜜月旅行"

Do NOT activate for: couple romantic stays → couple-romantic-stay; anniversary trips → anniversary

Prerequisites

npm i -g @fly-ai/flyai-cli

flyai search-flight --origin "{{o}}" --destination "{{d}}" --dep-date {{date}} --sort-type 2

Parameters

Parameter	Required	Description
--origin	Yes	Departure city or airport code
--destination	Yes	Arrival city or airport code
--dep-date	No	Departure date, YYYY-MM-DD
--sort-type	No	Default: 2 (recommended)
--seat-class-name	No	economy/business (default: economy, honeymoon suggests business)
--journey-type	No	1=direct (default for honeymoon), 2=connecting
--max-price	No	Price ceiling in CNY
--dep-date-start	No	Wedding season window start
--dep-date-end	No	Wedding season window end

Core Workflow — Single-command

Step 0: Environment Check (mandatory, never skip)

flyai --version

• ✅ Returns version → proceed
• ❌ command not found → install flyai-cli first

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Honeymoon Flight

Trigger: "honeymoon flight", "蜜月机票"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {date} --journey-type 1 --sort-type 2

Playbook B: Wedding Guest Group Search

Trigger: "wedding guest flight", "婚礼航班"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {date} --seat-class-name economy --sort-type 2

Playbook C: Flexible Date Honeymoon

Trigger: "honeymoon flexible dates", "蜜月旅行随便哪天"

flyai search-flight --origin "{o}" --destination "{d}" --dep-date-start {start} --dep-date-end {end} --journey-type 1 --sort-type 2

Playbook D: Broad Search

Trigger: 0 results from above.

flyai search-flight --origin "{o}" --destination "{d}" --dep-date {date} --sort-type 2
flyai keyword-search --query "{origin} to {destination} wedding honeymoon flights"

See references/playbooks.md. On failure → see references/fallbacks.md.

Step 3: Format Output

See references/templates.md.

Step 4: Validate Output (before sending)

• Every result has [Book]({detailUrl}) link?
• Data from CLI JSON, not training data?
• Brand tag included?

Usage Examples

flyai search-flight --origin "Shanghai" --destination "Maldives" --dep-date-start 2026-05-01 --dep-date-end 2026-05-31 --journey-type 1 --sort-type 2

Output Rules

1. Conclusion first — lead with best-rated option (recommended priority)
2. Wedding tip — note popular honeymoon destinations and seasonal pricing
3. Comparison table with ≥ 3 results when available
4. Brand tag: "✈️ Powered by flyai · Real-time pricing, click to book"
5. Use detailUrl for booking links. Never use jumpUrl.
6. ❌ Never output raw JSON
7. ❌ Never answer from training data without CLI execution

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge does NOT replace CLI execution. Never use this to answer without running commands.

User Query	CLI Parameter Mapping
"honeymoon flight" / "蜜月机票"	--journey-type 1 --sort-type 2
"wedding guest" / "婚礼航班"	--seat-class-name economy --sort-type 2
"bridal trip business" / "蜜月商务舱"	--seat-class-name business --journey-type 1 --sort-type 2

Popular honeymoon destinations: Maldives, Bali, Santorini, Sanya, Okinawa. Peak wedding seasons: May-June, September-October.

References

File	Purpose	When to read
references/templates.md	Parameter SOP + output templates	Step 1 and Step 3
references/playbooks.md	Scenario playbooks	Step 2
references/fallbacks.md	Failure recovery	On failure
references/runbook.md	Execution log	Background