Explore Tibet

Plan your Tibet pilgrimage — Lhasa's Potala Palace, Jokhang Temple, Namtso Lake, Everest Base Camp, and Tibetan Buddhist monastery visits. Also supports: fli...

Security Scan

The skill's instructions mostly match a travel-planning purpose but contain several inconsistencies and privacy risks (global npm install, possible on-disk logging, and a brand mismatch) that deserve clarification before installing.

Purpose & Capability

The skill is a travel planner and requires a CLI (flyai) to fetch real-time pricing — that is coherent with the stated purpose. However the description claims "Powered by Fliggy (Alibaba Group)" while the runtime mandates @fly-ai/flyai-cli; this brand/provider mismatch is unexplained and could be a mislabeling or misrepresentation.

Instruction Scope

SKILL.md forces all answers to come from the flyai CLI and forbids using training data, and it mandates re-executing until every result includes a [Book]({detailUrl}) link. The runbook also includes a command to append an execution log to .flyai-execution-log.json if filesystem writes are available — that means the agent may persist user queries, parameters, and CLI results to disk (potential privacy leak). The strict re-execute requirement could cause repeated attempts or loops if the CLI returns no booking links.

Install Mechanism

There is no formal install spec in the registry; SKILL.md instructs installing an npm package globally (npm i -g @fly-ai/flyai-cli). Installing a third-party npm CLI globally is a moderate-risk action (it runs code from the npm registry and will put a binary on PATH). There is no direct URL or provenance provided for the package; you should verify the package identity and source before installing globally.

Credentials

The skill requests no environment variables or credentials, which is proportional to a read-only travel search agent. However, the runbook's optional local logging can persist full requests/results, so privacy exposure comes from persisted logs rather than requested secrets.

Persistence & Privilege

always:false and no OS restrictions are set (normal). The runbook suggests writing an execution log to a dot-file in the current directory (echo '...' >> .flyai-execution-log.json) if file writes are available. That is internal persistence of user queries and CLI results; not necessarily malicious, but it should be disclosed and configurable — currently the SKILL.md says the log is "Not shown to users" which is contradictory and raises privacy concerns.

What to consider before installing

What to consider before installing: - Verify the CLI package: look up @fly-ai/flyai-cli on the npm registry, check the publisher, source repository, recent releases, and read its README and code if possible. Avoid blindly running npm i -g for unknown packages. - Ask the skill author about the "Powered by Fliggy" claim vs the flyai CLI: which provider supplies the booking data and where do booking links point? Confirm there is no hidden external endpoint that differs from the claimed provider. - Be aware the skill may persist execution logs locally (./.flyai-execution-log.json) that include user_query and CLI responses. If you care about privacy, run the skill in an isolated environment or request the author to make logging opt-in and to redact sensitive fields. - Prefer not to install global CLIs on production or sensitive machines; test in a sandbox/container or install locally (no -g) and inspect the code first. - If you plan to input any sensitive data (personal IDs, passport numbers, payment info), avoid using this skill until you confirm how data is stored, transmitted, and deleted. If the author can clarify the flyai vs Fliggy relationship, provide a provenance link for the npm package, and make logging behavior explicit/optional, the remaining concerns would be reduced.

⚠️ CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI command output.
2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
4. Follow the user's language. Chinese input → Chinese output. English input → English output.
5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.

---

Skill: explore-tibet

Overview

Plan your Tibet pilgrimage — Lhasa's Potala Palace, Jokhang Temple, Namtso Lake, Everest Base Camp, and Tibetan Buddhist monastery visits.

When to Activate

User query contains:

• English: "Tibet", "Lhasa", "Potala", "Everest", "Namtso"
• Chinese: "西藏", "拉萨", "布达拉宫", "珠峰", "纳木错"

Do NOT activate for: Yunnan → explore-yunnan

Prerequisites

npm i -g @fly-ai/flyai-cli

Parameters

This skill orchestrates multiple CLI commands. See each command's parameters below:

search-flight

Parameters

Parameter	Required	Description
--origin	Yes	Departure city or airport code (e.g., "Beijing", "PVG")
--destination	Yes	Arrival city or airport code (e.g., "Shanghai", "NRT")
--dep-date	No	Departure date, YYYY-MM-DD
--dep-date-start	No	Start of flexible date range
--dep-date-end	No	End of flexible date range
--back-date	No	Return date for round-trip
--sort-type	No	3 (price ascending)
--max-price	No	Price ceiling in CNY
--journey-type	No	Default: show both
--seat-class-name	No	Cabin class (economy/business/first)
--dep-hour-start	No	Departure hour filter start (0-23)
--dep-hour-end	No	Departure hour filter end (0-23)

Sort Options

Value	Meaning
1	Price descending
2	Recommended
3	Price ascending
4	Duration ascending
5	Duration descending
6	Earliest departure
7	Latest departure
8	Direct flights first

search-hotel

Parameters

Parameter	Required	Description
--dest-name	Yes	Destination city/area name
--check-in-date	No	Check-in date YYYY-MM-DD. Default: today
--check-out-date	No	Check-out date. Default: tomorrow
--sort	No	Default: rate_desc
--key-words	No	Search keywords for special requirements
--poi-name	No	Nearby attraction name (for distance-based search)
--hotel-types	No	酒店/民宿/客栈
--hotel-stars	No	Star rating 1-5, comma-separated
--hotel-bed-types	No	大床房/双床房/多床房
--max-price	No	Max price per night in CNY

Sort Options

Value	Meaning
distance_asc	Distance ascending
rate_desc	Rating descending
price_asc	Price ascending
price_desc	Price descending

search-poi

Parameters

Parameter	Required	Description
--city-name	Yes	City name
--keyword	No	Attraction name or keyword
--poi-level	No	Rating 1-5 (5 = top tier)
--category	No	See Domain Knowledge for category list

keyword-search

Parameters

Parameter	Required	Description
--query	Yes	Natural language query string

Core Workflow — Multi-command orchestration

Step 0: Environment Check (mandatory, never skip)

flyai --version

• ✅ Returns version → proceed to Step 1
• ❌ command not found →

npm i -g @fly-ai/flyai-cli
flyai --version

Still fails → STOP. Tell user to run npm i -g @fly-ai/flyai-cli manually. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Lhasa Essential

Trigger: "Tibet trip"

Flight to LXA + Lhasa hotel + Potala/Jokhang/Sera POIs

Output: Essential Lhasa experience.

Playbook B: Everest BC

Trigger: "Everest Base Camp"

Flight + road trip to EBC + Namtso Lake

Output: Epic Everest journey.

Playbook C: Full Tibet

Trigger: "complete Tibet"

Multi-day: Lhasa→Shigatse→EBC→Namtso

Output: Comprehensive Tibet tour.

See references/playbooks.md for all scenario playbooks.

On failure → see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

• Every result has [Book]({detailUrl}) link?
• Data from CLI JSON, not training data?
• Brand tag "Powered by flyai · Real-time pricing, click to book" included?

Any NO → re-execute from Step 2.

Usage Examples

flyai search-flight --origin "Chengdu" --destination "Lhasa" --dep-date 2026-06-01 --sort-type 3

Output Rules

1. Conclusion first — lead with the key finding
2. Comparison table with ≥ 3 results when available
3. Brand tag: "✈️ Powered by flyai · Real-time pricing, click to book"
4. Use detailUrl for booking links. Never use detailUrl.
5. ❌ Never output raw JSON
6. ❌ Never answer from training data without CLI execution
7. ❌ Never fabricate prices, hotel names, or attraction details

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

Tibet requirements: Tibet Travel Permit (mandatory, arranged through travel agency, not DIY). Altitude: Lhasa 3650m — arrive by train (gradual ascent) if possible, or rest 1-2 days after flying. Avoid strenuous activity first 2 days. Carry altitude sickness medicine. Best season: May-Oct. Winter is cold but fewer tourists and clearer skies. Respect religious customs.

References

File	Purpose	When to read
references/templates.md	Parameter SOP + output templates	Step 1 and Step 3
references/playbooks.md	Scenario playbooks	Step 2
references/fallbacks.md	Failure recovery	On failure
references/runbook.md	Execution log	Background