Brouter

This skill generally does what it says (calls brouter.de and writes a GPX file), but review these issues before installing: - Network privacy: index.js calls brouter.de over plain HTTP (http://brouter.de). Coordinates and route requests will be sent unencrypted and could be intercepted. Prefer HTTPS or confirm brouter.de behavior. - Local logging: the skill appends structured logs (including the options object which contains start/end coordinates) to brouter.log in the skill directory. If you care about location privacy, plan for log retention, rotation, or disable logging. - File-write controls: you can override outputDir and fileName when invoking run(). The code does not sanitize a supplied fileName/outputDir, so a malicious or buggy invocation might write files outside the intended routes/ folder. Restrict who/what can call this skill or validate inputs before invoking. - Geocoding: SKILL.md asks the agent to geocode free-text locations. That will involve calling external geocoding services (and sending user location text) — choose a trusted geocoder and be aware of data sent to it. - Runtime setup: package.json lists dependencies; ensure node modules are installed in a controlled environment (npm install) before use. If you accept these risks, restrict invocation to trusted agents/processes, run the skill in a sandboxed environment, prefer HTTPS, and consider editing index.js to (a) use HTTPS, (b) avoid writing sensitive data to logs or make logging optional, and (c) validate/sanitize outputDir and fileName to prevent arbitrary writes.