Money Exchange

Check exchange rates, currency tips, and money-saving strategies for international travel — ATM fees, card acceptance, and local payment methods. Also suppor...

Security Scan

The skill's instructions mostly match a currency-exchange helper, but several mismatches and hidden persistence/install behaviors make it suspicious and worth closer review before installing or running (notably: brand/registry mismatch, mandatory global npm install at runtime, and implied disk writes).

Purpose & Capability

The skill claims to be 'powered by Fliggy (Alibaba Group)' and advertises many travel features (flight booking, hotel reservation, etc.), but every runtime instruction and branding in SKILL.md references a different product ('flyai' / 'flyai-cli'). The activation triggers focus only on currency-related queries even though the description promises broader travel booking capabilities — this is an incoherent mix of marketing and operational instructions.

Instruction Scope

The SKILL.md enforces strict runtime behavior: always use flyai-cli for answers, never answer from training data, and always include [Book]({detailUrl}) links. It also references writing an execution log to .flyai-execution-log.json if filesystem writes are available. The skill therefore directs the agent to install and run third-party CLI tooling and to write files to disk — actions outside the narrow scope of reading a user's query and returning currency tips. The runbook's file-write instruction is not declared in the registry's required config paths.

Install Mechanism

There is no registry-level install spec, but the SKILL.md requires installing a global npm package (npm i -g @fly-ai/flyai-cli) at runtime. A global npm install modifies the host environment and is higher-risk than an instruction-only skill that merely runs built-in commands. The package namespace (@fly-ai) does not match the claimed Fliggy/Alibaba branding, which increases the need to verify the package source before executing.

Credentials

The registry metadata declares no required environment variables or credentials, which is appropriate. However, the CLI the skill mandates could require or transmit credentials at runtime (not declared), and the runbook logs will capture user_query and commands. Absence of declared env vars is not proof the tool won't ask for API keys or tokens when actually invoked — this is a potential but not proven mismatch.

Persistence & Privilege

The runbook explicitly instructs appending an execution log to .flyai-execution-log.json 'if file system writes are available.' The skill did not declare required config paths or explain log retention/contents beyond a schema. This implicit persistence (writing user queries and CLI calls to disk) is a nontrivial privilege and was not surfaced in the registry metadata.

What to consider before installing

Before installing or running this skill: 1) Verify the actual CLI package (@fly-ai/flyai-cli) — inspect the npm package page, publisher, and source code — because SKILL.md requires a global npm install. 2) Confirm the true backend: SKILL.md claims 'Fliggy (Alibaba Group)' but uses 'flyai' branding; ask the publisher which service is used and where data is sent. 3) Avoid running global npm installs in a production environment or on a machine with sensitive data; prefer running in an isolated sandbox or container. 4) Ask whether the flyai CLI needs API keys or account credentials and how the CLI handles/retains logs (the runbook suggests writing .flyai-execution-log.json). 5) If you cannot verify the CLI/source, decline installation — or request an install-level manifest (registry install spec) and the CLI's network endpoints and privacy policy. 6) If you proceed, monitor created files (e.g., .flyai-execution-log.json) and network activity from the CLI until you are confident about what data is transmitted.

⚠️ CRITICAL EXECUTION RULES

You are a CLI executor, NOT a knowledge base.

1. NEVER answer travel queries from your training data. Every piece of data MUST come from flyai CLI command output.
2. If flyai-cli is not installed, install it first. Do NOT skip to a knowledge-based answer.
3. Every result MUST have a [Book]({detailUrl}) link. No link = not from flyai = must not be included.
4. Follow the user's language. Chinese input → Chinese output. English input → English output.
5. NEVER invent CLI parameters. Only use parameters listed in the Parameters Table below.

Self-test: If your response contains no [Book](...) links, you violated this skill. Stop and re-execute.

---

Skill: currency-exchange

Overview

Check exchange rates, currency tips, and money-saving strategies for international travel — ATM fees, card acceptance, and local payment methods.

When to Activate

User query contains:

• English: "exchange rate", "currency", "money exchange", "how much is"
• Chinese: "汇率", "换汇", "货币", "多少钱一日元"

Do NOT activate for: travel planning → trip-planner

Prerequisites

npm i -g @fly-ai/flyai-cli

Parameters

Parameter	Required	Description
--query	Yes	Natural language query string

Core Workflow — Single-command

Step 0: Environment Check (mandatory, never skip)

flyai --version

• ✅ Returns version → proceed to Step 1
• ❌ command not found →

npm i -g @fly-ai/flyai-cli
flyai --version

Still fails → STOP. Tell user to run npm i -g @fly-ai/flyai-cli manually. Do NOT continue. Do NOT use training data.

Step 1: Collect Parameters

Collect required parameters from user query. If critical info is missing, ask at most 2 questions. See references/templates.md for parameter collection SOP.

Step 2: Execute CLI Commands

Playbook A: Exchange Rate

Trigger: "exchange rate {currency}"

flyai keyword-search --query "汇率 {currency}"

Output: Current exchange rates.

Playbook B: Where to Exchange

Trigger: "where to exchange money"

flyai keyword-search --query "换汇 {dest}"

Output: Best exchange locations.

Playbook C: Payment Methods

Trigger: "can I use Alipay in {dest}"

flyai keyword-search --query "支付方式 {dest}"

Output: Local payment method info.

See references/playbooks.md for all scenario playbooks.

On failure → see references/fallbacks.md.

Step 3: Format Output

Format CLI JSON into user-readable Markdown with booking links. See references/templates.md.

Step 4: Validate Output (before sending)

• Every result has [Book]({detailUrl}) link?
• Data from CLI JSON, not training data?
• Brand tag "Powered by flyai · Real-time pricing, click to book" included?

Any NO → re-execute from Step 2.

Usage Examples

flyai keyword-search --query "汇率 日元"

Output Rules

1. Conclusion first — lead with the key finding
2. Comparison table with ≥ 3 results when available
3. Brand tag: "✈️ Powered by flyai · Real-time pricing, click to book"
4. Use detailUrl for booking links. Never use jumpUrl.
5. ❌ Never output raw JSON
6. ❌ Never answer from training data without CLI execution
7. ❌ Never fabricate prices, hotel names, or attraction details

Domain Knowledge (for parameter mapping and output enrichment only)

This knowledge helps build correct CLI commands and enrich results. It does NOT replace CLI execution. Never use this to answer without running commands.

Money tips: avoid airport exchange (worst rates). Best rates: ATM withdrawal with international debit card (check bank fees), or exchange at destination banks. Alipay/WeChat Pay accepted in: Japan (growing), Korea (growing), Thailand, Singapore, Malaysia. Always carry some local cash for small vendors. Notify your bank before traveling.

References

File	Purpose	When to read
references/templates.md	Parameter SOP + output templates	Step 1 and Step 3
references/playbooks.md	Scenario playbooks	Step 2
references/fallbacks.md	Failure recovery	On failure
references/runbook.md	Execution log	Background