check charger availbility
v1.0.1Check EV charger availability (favorites, nearby search) via Google Places.
⭐ 1· 2k·0 current·0 all-time
by@borahm
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's purpose (Google Places EV data) legitimately requires a GOOGLE_PLACES_API_KEY; SKILL.md lists that requirement and state dirs (.cache). However the registry summary for this published skill claims no required env vars or config paths — an inconsistency. Also SKILL.md says the bundle includes a Node.js CLI 'bin/charger', but that file is not present in the bundle. These mismatches mean the skill as published is incomplete or improperly declared.
Instruction Scope
The runtime instructions and the provided script stay within the expected scope: they run 'charger check <target>', parse its stdout for availability, and record per-target state in ~/.cache/charger-notify. The script does not attempt to read unrelated system files or exfiltrate data. It does assume a 'charger' CLI on PATH and writes state files under the user's home directory.
Install Mechanism
There is no install spec (instruction-only), which is low risk in principle. However SKILL.md claims a 'bin/charger' CLI (Node.js) that is not included in the bundle. The instructions expect the user to place/link that CLI at /home/claw/clawd/bin/charger, but no source or install guidance for the CLI is provided. Missing actual CLI files or a clear install step is a practical problem and raises trust questions about where to obtain that executable.
Credentials
The only sensitive item referenced in SKILL.md is GOOGLE_PLACES_API_KEY, which is appropriate for a Google Places-based charger checker. The provided script itself does not read arbitrary env vars. The concern is that the registry metadata omitted this required env var, and SKILL.md suggests storing the key in ~/.clawdbot/.env — the discrepancy should be resolved so users know what credentials are required and how they are consumed (by the missing CLI).
Persistence & Privilege
The skill does not request always:true, does not modify other skills or system-wide configs, and only writes small state files under ~/.cache/charger-notify. That level of persistence is reasonable for a notification helper.
What to consider before installing
Before installing or enabling this skill: 1) Be aware the bundle does NOT include the claimed 'bin/charger' Node CLI — ask the publisher for the CLI source or a trusted install method (npm package, GitHub release, etc.). Do not place an untrusted binary on your PATH. 2) The SKILL.md requires a GOOGLE_PLACES_API_KEY (appropriate for this purpose); confirm the registry metadata is updated and limit the API key's scope/quotas. 3) The helper script writes state files to ~/.cache/charger-notify and expects the CLI at /home/claw/clawd/bin — verify and agree with these paths before wiring to cron or Telegram. 4) If you plan to wire notifications into a gateway/Telegram, verify the sender component (cron-to-Telegram) and ensure secrets (bot tokens) are stored securely and are not requested by this skill. 5) If you want higher assurance, request the missing CLI code or an install manifest and re-run the evaluation; the current inconsistencies justify caution.Like a lobster shell, security has layers — review code before you run it.
Plugin bundle (nix)
Skill pack · CLI binary · Config
SKILL.mdCLIConfig
Config requirements
Required envGOOGLE_PLACES_API_KEY
State dirsconfig, .cache
latestvk971d73ze2cemhpvd2w79s4e917zngz1
License
MIT-0
Free to use, modify, and redistribute. No attribution required.