OpenCLAW Tour Planner
PassAudited by ClawScan on May 10, 2026.
Overview
This travel-planning skill appears purpose-aligned, but users should notice its optional weather API key use, public API calls, npm dependencies, and local cache.
Before installing, verify the source repository or package, only set VISUAL_CROSSING_API_KEY if you want the optional weather fallback, avoid placing real unused keys in configuration examples, and delete or redirect the local cache if you do not want destination lookup data stored locally.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If you set this key, it may be used against your Visual Crossing account quota, but the behavior is tied to the stated weather feature.
The skill can read an optional local weather API key and send it to the Visual Crossing provider when the keyless Open-Meteo request fails.
const vcKey = process.env.VISUAL_CROSSING_API_KEY; ... params: { unitGroup: 'metric', key: apiKey, contentType: 'json' }Use a dedicated low-privilege/free-tier weather key if desired, and do not set unrelated or unnecessary API keys.
Destination-related API responses and guide content may remain on disk until expiry or deletion, and public guide content can influence generated plans.
The skill keeps a local persistent cache of retrieved travel data so repeated requests can reuse it.
Writes API responses to `~/.openclaw/cache/tour-planner.db` ... Raw API responses (geocoding results, weather forecasts, travel guides). ... TTLs: Geocoding 30 days · Wikivoyage guides 7 days · Weather 1 hour.
Delete or redirect the cache if you do not want travel lookup data retained, and treat retrieved travel-guide text as informational data rather than trusted instructions.
Installing the runnable package depends on npm supply-chain trust and a native build dependency, although this is common and purpose-aligned for the documented cache.
Manual npm installation pulls third-party packages, including a native SQLite module used for the local cache.
"dependencies": { "axios": "^1.6.0", "better-sqlite3": "^9.4.0" }Install from the claimed repository or ClawHub package you trust, review package-lock integrity, and avoid running npm install from an unverified fork.