Car Connect

Control multiple car brands — Tesla, BYD, Rivian, Mercedes, Volkswagen — with one skill. Check tyre pressure, charge, climate, lock/unlock, location, and mor...

Security Scan

The skill's code and instructions generally match its stated purpose (multi‑brand car control) but there are metadata inconsistencies, missing provenance, and proportionality/installation risks (many sensitive email/password env vars and third‑party pip packages) that warrant caution before installing.

Purpose & Capability

The SKILL.md, commands, and Python code implement multi‑brand car control and require the per‑brand credentials that are plausibly needed to call official connected car APIs. However the registry metadata shown at the top lists 'Required env vars: none' and 'No install spec', which contradicts the SKILL.md that clearly lists many env vars and pip installs — this metadata mismatch is a red flag about packaging/accuracy.

Instruction Scope

The runtime instructions are focused on installing Python libraries, exporting per‑brand environment variables, running an auth step, and invoking the included CLI script. The script only reads/writes tokens under ~/.car_connect and environment variables and otherwise calls the brand libraries. I did not find instructions that request unrelated system files or exfiltrate data to unexpected endpoints in the provided files.

Install Mechanism

Although the registry summary claimed no install spec, SKILL.md and embedded metadata instruct users to pip install multiple third‑party packages (teslapy, hyundai_kia_connect_api, pymyhondaplus, pytoyoda, fordpass). Installing several external PyPI packages increases supply‑chain risk; there is no published homepage/source repo in the registry to verify authorship. The skill itself is provided as code (scripts/car_connect.py), so running it will execute local code that depends on these packages.

Credentials

The skill asks for many sensitive credentials (email and password pairs for multiple automaker accounts). Those are reasonable for authenticating to some OEM APIs, but they are high‑sensitivity secrets. The SKILL.md recommends exporting them as environment variables (which can be exposed in process lists or shell history if handled poorly). The top-level registry metadata incorrectly reported no required env vars, adding to the concern.

Persistence & Privilege

always:false (no forced inclusion). The script persists tokens to ~/.car_connect/{brand}_token.json and sets file perms to 600 — that is scoped to the user's home directory and is expected. Keep in mind that the platform allows autonomous invocation by default; if you provide credentials the skill could be invoked by an agent (normal behavior) so you should consider who/what can trigger it.

What to consider before installing

This skill appears to do what it claims but there are practical risks you should weigh before installing: (1) provenance: the registry lists no homepage and the owner is unknown — prefer skills with a verifiable source (GitHub repo, official maintainer). (2) secrets: the skill asks for many email/password environment variables; avoid putting long‑term passwords in globally exported env vars — use service tokens or ephemeral creds if available and restrict where you export them (use a dedicated shell session or credential manager). (3) supply‑chain: the SKILL.md asks you to pip install multiple third‑party packages from PyPI; install them in a virtualenv, review the packages' repos and recent activity, and consider pinning versions. (4) inspect code: review the full car_connect.py for any network endpoints or unexpected behavior beyond calling official OEM libraries. (5) least privilege: only provide credentials for manufacturers you actually use. If you proceed and later feel uncomfortable, rotate/revoke the car account credentials and delete ~/.car_connect token files. If you want higher assurance, ask the publisher for a public source repository and review commit history before use.

Author: Suvo — @deadlybutsoft Version: 3.0.0 | Brands: Tesla, Mercedes, Volkswagen, Toyota, Ford, Kia, Honda

Control multiple car brands from your terminal. Each brand uses its official connected services API.

Supported Brands

Brand	API	Features	Env Vars
Tesla	Tesla Owner API	Full control	TESLA_EMAIL
Mercedes	Mercedes Me API	Full control	MERCEDES_EMAIL, MERCEDES_PASSWORD
Volkswagen	We Connect ID	Full control	VW_EMAIL, VW_PASSWORD
Toyota	Toyota Connected (EU)	Status, climate	TOYOTA_EMAIL, TOYOTA_PASSWORD
Ford	FordPass	Status, lock/unlock, engine	FORD_USERNAME, FORD_PASSWORD
Kia	UVO Connect	Full control	KIA_EMAIL, KIA_PASSWORD
Honda	My Honda+ (EU)	Lock/unlock/horn/climate	HONDA_EMAIL, HONDA_PASSWORD

Setup

1. Install dependencies

pip install teslapy hyundai_kia_connect_api pymyhondaplus pytoyoda fordpass

2. Set environment variables

# Tesla
export TESLA_EMAIL="[e-mail]"

# Mercedes
export MERCEDES_EMAIL="[e-mail]"
export MERCEDES_PASSWORD="your_password"

# Volkswagen
export VW_EMAIL="[e-mail]"
export VW_PASSWORD="your_password"

# Toyota (EU only)
export TOYOTA_EMAIL="[e-mail]"
export TOYOTA_PASSWORD="your_password"

# Ford
export FORD_USERNAME="[e-mail]"
export FORD_PASSWORD="your_password"

# Kia / Hyundai
export KIA_EMAIL="[e-mail]"
export KIA_PASSWORD="your_password"

# Honda (EU)
export HONDA_EMAIL="[e-mail]"
export HONDA_PASSWORD="your_password"

3. First-time authentication

# Tesla
python3 {baseDir}/scripts/car_connect.py auth tesla

# Mercedes
python3 {baseDir}/scripts/car_connect.py auth mercedes

# Volkswagen
python3 {baseDir}/scripts/car_connect.py auth volkswagen

# Kia / Hyundai
python3 {baseDir}/scripts/car_connect.py auth kia

# Honda
python3 {baseDir}/scripts/car_connect.py auth honda

# Toyota (EU)
python3 {baseDir}/scripts/car_connect.py auth toyota

# Ford
python3 {baseDir}/scripts/car_connect.py auth ford

Commands

List all cars (all brands)

python3 {baseDir}/scripts/car_connect.py list
python3 {baseDir}/scripts/car_connect.py list --brand tesla
python3 {baseDir}/scripts/car_connect.py list --brand kia
python3 {baseDir}/scripts/car_connect.py list --all

Status summary (all brands)

python3 {baseDir}/scripts/car_connect.py summary --brand tesla
python3 {baseDir}/scripts/car_connect.py summary --brand mercedes --car "EQS"
python3 {baseDir}/scripts/car_connect.py summary --brand volkswagen --car "ID4"
python3 {baseDir}/scripts/car_connect.py summary --brand kia --car "EV6"
python3 {baseDir}/scripts/car_connect.py summary --brand toyota --car "RAV4"
python3 {baseDir}/scripts/car_connect.py summary --brand honda --car "Honda e"
python3 {baseDir}/scripts/car_connect.py summary --brand ford
python3 {baseDir}/scripts/car_connect.py summary --all

Detailed status

python3 {baseDir}/scripts/car_connect.py status --brand tesla
python3 {baseDir}/scripts/car_connect.py status --brand kia --car "EV6"
python3 {baseDir}/scripts/car_connect.py status --json --brand tesla

Lock / Unlock

# Lock
python3 {baseDir}/scripts/car_connect.py lock --brand tesla --car "Model 3" --yes
python3 {baseDir}/scripts/car_connect.py lock --brand mercedes --yes
python3 {baseDir}/scripts/car_connect.py lock --brand kia --car "EV6" --yes
python3 {baseDir}/scripts/car_connect.py lock --brand honda --yes

# Unlock
python3 {baseDir}/scripts/car_connect.py unlock --brand tesla --car "Model 3" --yes
python3 {baseDir}/scripts/car_connect.py unlock --brand mercedes --yes
python3 {baseDir}/scripts/car_connect.py unlock --brand kia --car "EV6" --yes

Climate control

# Temperature (default: Fahrenheit)
python3 {baseDir}/scripts/car_connect.py climate temp 72 --brand tesla
python3 {baseDir}/scripts/car_connect.py climate temp 22 --celsius --brand kia

# Climate on/off
python3 {baseDir}/scripts/car_connect.py climate on --brand tesla --yes
python3 {baseDir}/scripts/car_connect.py climate off --brand tesla --yes

# Defrost
python3 {baseDir}/scripts/car_connect.py climate defrost on --brand tesla --yes
python3 {baseDir}/scripts/car_connect.py climate defrost on --brand mercedes --yes

# Climate start (Honda)
python3 {baseDir}/scripts/car_connect.py climate-start --brand honda --yes

Charge / Fuel

# Charge status (Tesla, Kia, Mercedes EV)
python3 {baseDir}/scripts/car_connect.py charge status --brand tesla
python3 {baseDir}/scripts/car_connect.py charge status --brand kia
python3 {baseDir}/scripts/car_connect.py charge status --brand mercedes

# Charge start/stop (safety gated)
python3 {baseDir}/scripts/car_connect.py charge start --brand tesla --yes
python3 {baseDir}/scripts/car_connect.py charge stop --brand tesla --yes
python3 {baseDir}/scripts/car_connect.py charge start --brand kia --car "EV6" --yes

# Charge limit (Tesla: 50-100%)
python3 {baseDir}/scripts/car_connect.py charge limit 80 --brand tesla --yes

# Fuel status (Volkswagen ICE, Ford)
python3 {baseDir}/scripts/car_connect.py fuel status --brand volkswagen
python3 {baseDir}/scripts/car_connect.py fuel status --brand ford

Location

# Approximate location
python3 {baseDir}/scripts/car_connect.py location --brand tesla
python3 {baseDir}/scripts/car_connect.py location --brand kia --car "EV6"

# Precise location
python3 {baseDir}/scripts/car_connect.py location --yes --brand tesla

Tyre pressure

python3 {baseDir}/scripts/car_connect.py tyres --brand tesla
python3 {baseDir}/scripts/car_connect.py tyres --brand kia
python3 {baseDir}/scripts/car_connect.py tyres --brand mercedes

Trunk / Frunk

# Open trunk
python3 {baseDir}/scripts/car_connect.py trunk open --brand tesla --yes
python3 {baseDir}/scripts/car_connect.py trunk open --brand kia --car "EV6" --yes

# Open frunk
python3 {baseDir}/scripts/car_connect.py frunk open --brand tesla --yes

Windows

# Status
python3 {baseDir}/scripts/car_connect.py windows --brand tesla

# Vent (open windows slightly)
python3 {baseDir}/scripts/car_connect.py windows vent --brand tesla --yes

# Close windows
python3 {baseDir}/scripts/car_connect.py windows close --brand tesla --yes

Honk / Flash (find car)

python3 {baseDir}/scripts/car_connect.py honk --brand tesla --yes
python3 {baseDir}/scripts/car_connect.py flash --brand tesla --yes
python3 {baseDir}/scripts/car_connect.py horn --brand honda --yes

Engine start/stop (Ford)

python3 {baseDir}/scripts/car_connect.py engine on --brand ford --yes
python3 {baseDir}/scripts/car_connect.py engine off --brand ford --yes

All brands summary

# One command for all configured brands
python3 {baseDir}/scripts/car_connect.py summary --all

# JSON output
python3 {baseDir}/scripts/car_connect.py summary --all --json

Safety Defaults

Actions requiring --yes confirmation:

• lock, unlock
• trunk open, frunk open
• windows vent, windows close
• charge start, charge stop, charge limit
• engine on, engine off
• climate on, climate defrost on, climate-start
• honk, flash, horn

Privacy

• Tokens cached locally only (brand-specific paths)
• Location is approximate by default
• Do not commit tokens, VINs, or precise location data
• Use --json for machine-readable, privacy-safe output

Examples

Morning check — all cars:

User: Check all my cars
Assistant: Runs summary --all for all 7 brands

Lock from bed:

User: Lock the Kia
Assistant: car-connect lock --brand kia --yes

Pre-heat before trip:

User: Start heating the Tesla
Assistant: car-connect climate defrost on --brand tesla --yes

Check charge before road trip:

User: How much charge does the VW have?
Assistant: car-connect charge status --brand volkswagen