Rivian Ls

Access Rivian vehicle telemetry (battery, range, charge state, locks, doors, tires, cabin temp, location) using the rivian-ls CLI tool. Use when the user ask...

Security Scan

The skill is internally consistent: it wraps the external rivian-ls CLI, includes a simple script that runs that CLI and formats output, and does not request unrelated credentials or install arbitrary code itself.

Purpose & Capability

Name/description match behavior: the skill simply runs the rivian-ls CLI to fetch vehicle telemetry and formats the output. Bundled script and documentation align with that purpose; nothing in the files attempts to access unrelated services.

Instruction Scope

Runtime instructions and the script call only the rivian-ls CLI and operate on its JSON output. The SKILL.md recommends installing rivian-ls, authenticating (including providing email/password/OTP), using cron to refresh caches, and optionally exposing data via a server-side exec example; these are within the scope of providing telemetry but do recommend actions (storing cached credentials, adding cron jobs, exposing API endpoints) that have privacy implications.

Install Mechanism

The skill itself has no install spec and includes only a small Python script; it instructs users to install the rivian-ls CLI from its GitHub repo or via Homebrew (both reasonable). No downloads from obscure URLs or archive extraction are performed by the skill bundle.

Credentials

The skill metadata declares no required environment variables, which is reasonable because authentication is handled by the external rivian-ls CLI. SKILL.md does reference optional environment variables (RIVIAN_EMAIL, RIVIAN_PASSWORD) and filesystem cache (~/.config/rivian-ls/credentials.json); this is expected but means users must trust the rivian-ls credential cache. No unrelated credentials are requested.

Persistence & Privilege

The skill is not always-on and does not modify other skills or system-wide agent settings. The README suggests creating a cron job to refresh the rivian-ls cache, which is a user-level operational recommendation rather than the skill asserting elevated privileges.

Assessment

This skill is a thin wrapper around the third-party rivian-ls CLI and appears to do what it claims. Before installing: (1) Confirm you trust the upstream rivian-ls project (the SKILL.md links to github.com/pfrederiksen/rivian-ls). (2) Be aware that authenticating requires your Rivian credentials and an OTP; rivian-ls caches tokens at ~/.config/rivian-ls/credentials.json — treat that file as sensitive. (3) If you expose data via a web endpoint or add the suggested cron job, you may unintentionally publish live vehicle location/status to others; secure any server endpoints and cron outputs. (4) Note the tool uses an unofficial API and may break. If you want tighter control, avoid placing credentials in environment variables or public cron jobs and prefer manual or local-only usage.

Fetch and work with Rivian vehicle telemetry via the rivian-ls CLI.

⚠️ Uses an unofficial Rivian API. May break without notice. Not affiliated with Rivian.

Installation

# From source (requires Go 1.21+)
git clone https://github.com/pfrederiksen/rivian-ls.git
cd rivian-ls && make build
cp rivian-ls /usr/local/bin/

# Or via Homebrew
brew install pfrederiksen/tap/rivian-ls

Authentication (Two-Phase MFA)

Rivian requires MFA. Use the two-phase flow for non-interactive / scripted login:

# Phase 1: Send credentials, triggers SMS code
rivian-ls login --email [e-mail] --password secret

# Phase 2: Complete with OTP after receiving SMS (within ~60 seconds)
rivian-ls login --otp 123456

Credentials cache to ~/.config/rivian-ls/credentials.json and auto-refresh. After initial auth, subsequent runs use the cache automatically.

Non-interactive (single command, if OTP is known in advance):

rivian-ls --email [e-mail] --password secret --otp 123456 login

Via environment variables:

export RIVIAN_EMAIL="[e-mail]"
export RIVIAN_PASSWORD="secret"
rivian-ls login  # then provide OTP when prompted

Key Commands

# Snapshot from cache (fast, no API call)
rivian-ls status --offline --format json

# Live fetch from Rivian API
rivian-ls status --format json

# Stream live updates (WebSocket, auto-falls back to polling)
rivian-ls watch --format json

# Export historical snapshots
rivian-ls export --format json --since 24h

# Multi-vehicle: select by index
rivian-ls status --vehicle 1 --format json

Bundled Script

Use scripts/rivian_status.py for clean text or JSON output:

# Human-readable summary
python3 scripts/rivian_status.py

# JSON (pipe to jq, dashboard APIs, etc.)
python3 scripts/rivian_status.py --format json

# Force live fetch
python3 scripts/rivian_status.py --live

Common Patterns

Status summary: Run python3 scripts/rivian_status.py — covers all key fields.

Check if locked: Parse IsLocked from JSON output. Alert if false and parked overnight.

Battery alert: Check BatteryLevel and RangeStatus. Alert if below threshold.

Dashboard API endpoint: Call rivian-ls status --offline --format json from a server-side handler. Use a cron job (0 * * * *) to keep the cache fresh.

Keep cache fresh (cron):

0 * * * * /usr/local/bin/rivian-ls status --format json > /dev/null 2>&1

Field Reference

See references/api-fields.md for the full JSON schema, all field descriptions, and known limitations.