Tomtom
v1.0.2TomTom integration. Manage data, records, and automate workflows. Use when the user wants to interact with TomTom data.
⭐ 0· 81·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description claim TomTom integration and the SKILL.md exclusively documents using the Membrane CLI to connect to TomTom, list actions, run actions, and proxy API requests — all coherent with the stated purpose.
Instruction Scope
Runtime instructions tell the agent to install/use the Membrane CLI, perform browser-based login, create/list connections, run actions, and proxy requests. These steps stay within the integration scope, but they imply sending requests and data through Membrane's servers (expected for a proxy-based integration), so the user must trust Membrane with any data sent via this skill.
Install Mechanism
There is no registry install spec (the skill is instruction-only). The SKILL.md recommends installing @membranehq/cli via `npm install -g` or using `npx`. This is a common approach but does pull code from the npm registry — users should verify the package and publisher before installing globally.
Credentials
The skill declares no required environment variables or credentials. The instructions explicitly state that Membrane handles auth and that you should not supply TomTom API keys locally, which matches the declared requirements.
Persistence & Privilege
always is false and the skill does not request persistent system-wide changes or access to other skills' configuration. Autonomous invocation is allowed by default (platform normal) and is not combined with other concerning privileges.
Scan Findings in Context
[no_scan_findings] expected: The regex scanner found nothing because this is an instruction-only skill with no code files. That's expected; the security surface is the instructions and any external package the user installs (the Membrane CLI).
Assessment
This skill is coherent: it teaches the agent to use the Membrane CLI to talk to TomTom and does not ask for unrelated credentials. Before installing/running: 1) Verify the @membranehq/cli package and publisher on npm and inspect the GitHub repo if you can. 2) Remember that requests and data will flow through Membrane's servers when you use 'membrane request' or connections — do not send sensitive data you don't want exposed to that service. 3) Installing a global npm package affects your system PATH; consider installing in a contained environment (container/VM) if you need tighter isolation. 4) For headless or automated runs, follow the documented login flow and avoid pasting secrets into chat or prompts. If you want extra assurance, review the Membrane CLI source code before installing.Like a lobster shell, security has layers — review code before you run it.
latestvk97d1byfewp69xcq8918qgcw6d843ydc
License
MIT-0
Free to use, modify, and redistribute. No attribution required.