OpenCLAW Tour Planner
v1.0.2Universal travel planning skill for OpenClaw agents. Plan itineraries, check weather, discover attractions, and estimate budgets — all through natural conver...
⭐ 0· 381·2 current·2 all-time
byAsif@asif2bd
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the implementation: geocoding (Nominatim), weather (Open-Meteo primary, Visual Crossing optional), and Wikivoyage are used and make sense for itinerary and budget estimation. Small inconsistency: registry metadata labels the package as 'instruction-only', yet the bundle includes full TypeScript sources and a package.json with dependencies (axios, better-sqlite3). The presence of better-sqlite3 is consistent with the stated local SQLite cache, so this is likely benign but worth noting.
Instruction Scope
SKILL.md and source code limit action to making outbound HTTP requests to public APIs and writing a local SQLite cache. The runtime instructions do not ask the agent to read unrelated system files or exfiltrate data. One privacy note: cache keys include user query/geocode keys (e.g., 'geo:<query>') and the skill writes API responses to a local DB; the author states user itineraries/personal data are not stored, but cached API responses could reflect user queries (location names).
Install Mechanism
No registry-level install spec was provided (lowest-risk), but SKILL.md instructs users to run 'npm install' or use the OpenClaw CLI. package.json lists axios and better-sqlite3. better-sqlite3 is a native module that builds during npm install (native C++ binding), which increases install complexity and requires a build toolchain on the host. There are no downloads from untrusted URLs and dependencies are from npm.
Credentials
The skill declares no required environment variables; it documents optional keys (VISUAL_CROSSING_API_KEY, OPENWEATHER_API_KEY, AMADEUS_* for future features) which are appropriate for those optional integrations. No unrelated secrets are requested. The code only reads VISUAL_CROSSING_API_KEY (optional fallback) and TOUR_PLANNER_CACHE_PATH for cache redirection.
Persistence & Privilege
The skill writes a persistent local SQLite cache (default: ~/.openclaw/cache/tour-planner.db). This is within its own scope and configurable via TOUR_PLANNER_CACHE_PATH. always:false (not force-included) and normal autonomous invocation is allowed. It does not request elevated OS privileges or modify other skills' configs.
Assessment
This skill appears to be what it claims: a travel planner that calls public APIs and caches responses in a local SQLite DB. Before installing, decide if you’re comfortable with a local cache file (default: ~/.openclaw/cache/tour-planner.db) and ensure your environment can build native npm modules (better-sqlite3). Optional API keys (Visual Crossing, OpenWeather, Amadeus) are not required for core features. If you need maximum privacy, set TOUR_PLANNER_CACHE_PATH to a directory you control or delete the DB periodically. If you want to be cautious, run the package in an isolated environment (container or sandbox) when first testing.Like a lobster shell, security has layers — review code before you run it.
latestvk97b9m5d370k6qhw1s9de62mm5820x2n
License
MIT-0
Free to use, modify, and redistribute. No attribution required.