← Back to Skills Marketplace
baizhexue

Fly Flight

by baizhexue · GitHub ↗ · v1.1.1 · MIT-0
cross-platform ⚠ suspicious
410
Downloads
0
Stars
0
Active Installs
3
Versions
Install in OpenClaw
/install fly-flight
Description
Query China domestic transport options through one skill. Use when a user wants domestic flight or high-speed rail results, departure and arrival times, stat...
README (SKILL.md)

Fly Flight

Use the unified transport entrypoint in this skill to handle China domestic trip lookup for both flights and high-speed rail.

这是一个统一的中国境内出行查询 skill,同时支持航班和高铁。 它通过同一个 transport 入口按 mode 路由到底层 provider。

Requirements

Require the following runtime environment before using this skill:

  • python3
  • node
  • Network access to Tongcheng public flight pages and official 12306 public endpoints

使用这个 skill 前,运行环境必须具备:

  • python3
  • node
  • 能访问同程公开航班页面和 12306 官方公开接口的网络环境

These dependencies are required whether the skill is installed from GitHub or from ClawHub.
无论这个 skill 是从 GitHub 安装还是从 ClawHub 安装,这些依赖都必须满足。

Current implementation status:

  • flight mode is implemented through Tongcheng public flight pages.
  • train mode is implemented through official 12306 public high-speed rail query and public price endpoints.

Quick Start

Flight query:

python3 {baseDir}/scripts/transport_service.py search \
  --mode flight --from 北京 --to 上海 --date 2026-03-20 --sort-by price --pretty

High-speed rail query:

python3 {baseDir}/scripts/transport_service.py search \
  --mode train --from 北京 --to 上海 --date 2026-03-20 \
  --seat-type second_class --sort-by price --pretty

The legacy flight-only entrypoint remains available for backward compatibility:

python3 {baseDir}/scripts/domestic_flight_public_service.py search \
  --from 北京 --to 上海 --date 2026-03-20 --sort-by price --pretty

Optional local HTTP mode:

python3 {baseDir}/scripts/transport_service.py serve --port 8766

Workflow

  1. Determine transport mode. Use flight for flights, airports, airlines, or plane tickets. Use train for high-speed rail, rail tickets, stations, or train numbers. If the user is ambiguous, infer conservatively from their wording or ask.

  2. Route to the correct provider. Use scripts/transport_service.py as the shared entrypoint. Flight mode delegates to scripts/providers/flight_public_service.py. Train mode delegates to scripts/providers/train_public_service.py.

  3. Preserve a shared outer response shape. Return mode, provider, trip_type, outbound, and optional return. Keep mode-specific fields inside each leg's options.

  4. Apply only mode-specific filters that make sense. Flight filters: airline, direct-only, preferred airports. Train filters: train type, seat type, preferred stations.

  5. Summarize results with the mode label. Clearly say whether the result is a flight result or a train result. Treat public-source prices as reference prices that can differ from final checkout prices.

Output Rules

  • Prefer up to 5 options unless the user asked for more.
  • State the exact travel date in YYYY-MM-DD.
  • Keep the outer response consistent across modes.
  • Do not force a single shared field schema for airports and stations; keep mode-specific details inside options.
  • For round trips, clearly separate outbound and return.
  • For train mode, explain that prices come from official public fare data and seat availability comes from public query results.

Resources

Usage Guidance
This skill appears to do what it says (China domestic flights and trains) and needs python3, node, and network access to public Tongcheng and 12306 endpoints — which is expected. However, two implementation choices increase risk: (1) the Node extractor eval()s JavaScript taken from fetched HTML, meaning a malicious or tampered page could execute code when you run the skill; (2) the train provider disables SSL certificate verification, making responses vulnerable to man-in-the-middle tampering. If you plan to install/run this skill: (a) only run it in a sandboxed environment or isolated container, (b) avoid running it on machines with sensitive credentials or access, (c) prefer using the sample-state/sample-* options when testing, and (d) consider modifying the code before use — replace eval() with a safer parser (or strict JSON extraction) and enable proper TLS verification. If you cannot audit or patch these issues, treat this skill as higher risk and avoid installing it on critical systems.
Capability Analysis
Type: OpenClaw Skill Name: fly-flight Version: 1.1.1 The skill bundle contains high-risk implementation patterns that introduce critical security vulnerabilities. Specifically, `scripts/extract_tongcheng_state.js` uses `eval()` to parse data extracted from the external website `ly.com`, which creates a potential Remote Code Execution (RCE) vector if the site content is manipulated. Additionally, `scripts/providers/train_public_service.py` explicitly disables SSL certificate verification (`ssl._create_unverified_context()`), exposing the agent to Man-in-the-Middle (MITM) attacks when communicating with `kyfw.12306.cn`. While these appear to be functional choices for web scraping rather than intentional malware, they represent significant security risks.
Capability Assessment
Purpose & Capability
Name/description, required binaries (python3, node), included provider scripts, and declared network access to Tongcheng and 12306 are consistent: python runs the CLI/HTTP entrypoint and providers, node is used to extract a JS payload from scraped flight HTML, and train code queries official 12306 endpoints.
Instruction Scope
Instructions and code perform only transport-related tasks and require network access to public endpoints as stated, but the Node extractor (scripts/extract_tongcheng_state.js) uses eval() to evaluate a payload taken from fetched HTML. Evaluating untrusted HTML content can execute arbitrary JavaScript and is a code-execution/exfiltration vector.
Install Mechanism
There is no remote install/download step; the skill is instruction-only (no install spec) and ships code in the bundle. That reduces supply-chain download risk, but the skill will execute local Python and Node code when invoked.
Credentials
The skill requests no secrets or config paths (appropriate), but the train provider intentionally disables SSL verification (ssl._create_unverified_context()) for 12306 connections, which weakens TLS and increases susceptibility to man-in-the-middle tampering of responses. Network access to public sites is necessary, but disabled verification is disproportionate and risky.
Persistence & Privilege
The skill does not request always:true or elevated persistence; it runs on demand and does not modify other skills or system-wide settings. Autonomous invocation is allowed by default, which is normal for skills.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install fly-flight
  3. After installation, invoke the skill by name or use /fly-flight
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.1.1
Emphasized runtime requirements in both GitHub and ClawHub docs. Added prominent dependency notes for python3, node, and network access. 补充并重点强调了依赖环境说明,明确要求 python3、node 以及可访问公开航班页面和 12306 官方接口的网络环境。
v1.1.0
Added unified flight + high-speed rail transport support, train mode via official 12306 public endpoints, a shared transport entrypoint, bilingual GitHub/ClawHub descriptions, and updated regression coverage. 新增统一的航班+高铁 transport skill,加入基于 12306 官方公开接口的 train 模式、共享 transport 入口、中英双语介绍,以及对应回归测试更新。
v1.0.0
Initial public release: China domestic flight lookup from public web pages, no API key required.
Metadata
Slug fly-flight
Version 1.1.1
License MIT-0
All-time Installs 0
Active Installs 0
Total Versions 3
Frequently Asked Questions

What is Fly Flight?

Query China domestic transport options through one skill. Use when a user wants domestic flight or high-speed rail results, departure and arrival times, stat... It is an AI Agent Skill for Claude Code / OpenClaw, with 410 downloads so far.

How do I install Fly Flight?

Run "/install fly-flight" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is Fly Flight free?

Yes, Fly Flight is completely free, licensed under MIT-0. You can download, install and use it at no cost.

Which platforms does Fly Flight support?

Fly Flight is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created Fly Flight?

It is built and maintained by baizhexue (@baizhexue); the current version is v1.1.1.

💬 Comments