Mercedes-Benz USA Utilities
v0.0.6Locate Mercedes-Benz dealerships and search for new vehicle inventory across the USA using zip code-based filters and detailed specifications.
⭐ 1· 127·0 current·0 all-time
by@kaudata
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description, SKILL.md, schema.json, and source code all align: the code queries MBUSA endpoints (nafta-service.mbusa.com) and returns dealer/inventory fields described in the manifest. No unrelated services, binaries, or credentials are requested.
Instruction Scope
SKILL.md restricts actions to dealer and inventory searches and explicitly asks for Markdown-formatted links. The implementation only calls MBUSA APIs and constructs Google Maps/website/image links. The instructions and code do not read local files, environment secrets, or transmit data to unexpected third-party endpoints.
Install Mechanism
The skill is declared instruction-only (no install spec), which is low-risk; however repository files (package.json, package-lock.json, server.js) indicate this can also run as a standalone Node/Express service and has a dependency on express. There's no downloaded/obfuscated third-party URL or archive in the install spec. If you intend to run the server, you'll fetch npm packages from the registry — standard but worth noting.
Credentials
No environment variables, credentials, or config paths are required. The skill does not attempt to access unrelated secrets or system configuration. The only network targets are MBUSA domains and Google Maps URLs (for directions).
Persistence & Privilege
Skill flags are default (always: false, user-invocable: true, disable-model-invocation: false). The skill does not request persistent system privileges or modify other skills. It exposes optional local HTTP endpoints if run as a server, which is normal for an included tool but should be run with standard host/network caution.
Assessment
This skill appears to do exactly what it says: query MBUSA APIs and return dealer/inventory data with clickable links. Before installing or running it: 1) Confirm you trust the source (owner ID is present but homepage is missing). 2) If you plan to run the included server, run npm install only in an isolated environment and be aware it will pull express and its transitive dependencies from the npm registry. 3) Expect queries (zip codes) to go to MBUSA servers — do not send sensitive personal data you wouldn't want sent to that site. 4) Review server.js if you intend to expose the HTTP server publicly (it listens on PORT and has no auth). 5) If you require an authoritative MBUSA integration, prefer an official MBUSA SDK or API documentation; this skill is explicitly unofficial.Like a lobster shell, security has layers — review code before you run it.
dealer-locatorvk97bngbqstnzx9pzgmc9tf9k1s84g9nqinventory-searchvk97bngbqstnzx9pzgmc9tf9k1s84g9nqlatestvk97bngbqstnzx9pzgmc9tf9k1s84g9nq
License
MIT-0
Free to use, modify, and redistribute. No attribution required.