TomTom Traffic Intelligence

Provides real-time traffic data, route calculation, and departure planning using TomTom Traffic API for commute and meeting alerts.

Security Scan

The skill appears to implement TomTom traffic features as described, but registry metadata omits the required TOMTOM_API_KEY and there are small mismatches (metadata vs runtime) that should be resolved before trusting/installing.

Purpose & Capability

The skill's name/description claim TomTom Traffic API usage and the code/SKILL.md clearly use TomTom API — that is coherent. However, the published registry metadata lists no required environment variables or primary credential while both SKILL.md and traffic-check.js require TOMTOM_API_KEY. This metadata omission is an incoherence and reduces trust (someone installing from the registry would not be warned they must supply an API key).

Instruction Scope

The runtime instructions and code stay within the stated purpose: calling TomTom endpoints, formatting route/alert data, and printing or returning results. The SKILL.md and code only reference TomTom endpoints and the local CONFIG; they do not read unrelated system files or send data to third-party endpoints beyond TomTom. Minor caveat: SKILL.md states 'No sensitive location data logged' but the CLI prints route/origin/destination info to stdout — acceptable for typical use but may expose location to anyone with access to console logs.

Install Mechanism

There is no install spec (instruction-only + a single JS file). No external downloads or package installs are performed by the skill. One operational note: the code uses fetch in Node — depending on the runtime Node version that may require Node 18+ or an explicit fetch polyfill; this is an operational compatibility issue, not a security risk.

Credentials

The TOMTOM_API_KEY requested by the SKILL.md and enforced by the code is proportional to the skill's function (calling TomTom API). However, the skill registry metadata declares 'Required env vars: none' and 'Primary credential: none' which is incorrect and misleading. No unrelated secrets are requested by the code.

Persistence & Privilege

The skill does not request persistent/always-on inclusion, does not declare system config paths, and does not modify other skills' configs. It runs as a normal user-space script and exports a module for integration; privileges requested are appropriate for the stated function.

What to consider before installing

This skill generally does what it says (calls TomTom Traffic API and computes departure times), but the registry metadata is missing a critical requirement: you must set TOMTOM_API_KEY in your environment. Before installing or running it: 1) Ensure you trust the source — owner/homepage are unknown; 2) Provide a TomTom API key (store it in an environment variable, do not hard-code it into repo); 3) Verify your Node runtime supports fetch (Node 18+ or add a polyfill); 4) Be aware the script prints route and location info to stdout — don't run it where console logs are exposed to untrusted parties; 5) Ask the maintainer to update registry metadata to declare TOMTOM_API_KEY as a required credential and, ideally, provide a homepage or repo so you can review changes and history. If those metadata and provenance issues are resolved, the skill appears coherent with its purpose.

Traffic Intelligence Skill

Overview

Provides real-time traffic monitoring, route calculation, and departure planning using TomTom Traffic API (2,500 free requests/day).

Prerequisites

1. TomTom Developer Account: https://developer.tomtom.com/
2. API Key from TomTom Traffic API
3. Set environment variable: export TOMTOM_API_KEY="your_key_here"

Configuration

Default locations are configured for Seattle/Bellevue area. Edit ./traffic-check.js to update:

• CONFIG.locations: Set your home, work, and frequent destinations
• CONFIG.buffers: Adjust parking, coffee, and meeting buffer times

Usage

Direct CLI Commands

# Check current commute (home → work)
node ./traffic-check.js check

# Plan departure for 8:00 AM meeting
node ./traffic-check.js meeting 08:00

# Test API connection
node ./traffic-check.js test

Integration with Meeting Alerts

The traffic module can be called from other scripts to enhance meeting alerts with real-time traffic data.

Example Integration

const TrafficIntelligence = require('./traffic-check.js');
const traffic = new TrafficIntelligence(process.env.TOMTOM_API_KEY);

// Get traffic-aware departure time for coffee meeting
const route = await traffic.calculateRoute(home, coffeeShop);
const meetingInfo = traffic.calculateDepartureTime(
  meetingTime,
  route.totalTimeMinutes,
  { meetingBuffer: 10 }
);

console.log(traffic.generateAlert(route, meetingInfo));

API Limits

• Free Tier: 2,500 requests/day
• Recommendation: Cache results for 5-10 minutes during peak hours
• Monitoring: Check TomTom dashboard for usage statistics

Error Handling

• Missing API key: Error message with setup instructions
• API failure: Graceful degradation with cached/last-known data
• Network issues: Retry logic with exponential backoff

Security Notes

• API key stored in environment variable (not in code)
• No sensitive location data logged
• Rate limiting to prevent accidental overuse

Future Enhancements

1. Historical traffic patterns
2. Weather integration (rain/snow impact)
3. Multiple route alternatives
4. Public transit integration
5. Traffic camera status

---

Maintainer: Agent M Last Updated: 2026-03-19 Status: Operational