Umeå Data
v1.0.0Query public open data from Umeå kommun on locations, facilities, demographics, environment, infrastructure, and building permits with geospatial support.
⭐ 1· 2.2k·1 current·2 all-time
by@simskii
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The skill's stated purpose (query Umeå open data) matches the API endpoints used. However, the package metadata declares no required binaries while the shipped scripts clearly call curl and jq — these should be declared. This mismatch is an incoherence that could cause runtime failures or conceal additional requirements.
Instruction Scope
SKILL.md and the scripts restrict actions to querying a public API (https://opendata.umea.se) and processing results. The instructions do not ask for secrets, nor do they reference unrelated system files or external endpoints beyond the official open-data domain.
Install Mechanism
There is no install spec (instruction-only), so nothing is downloaded or written by an installer. This is low risk, but it increases the importance of reviewing included scripts before running them locally.
Credentials
The skill declares no required environment variables or credentials (appropriate for public data). However, the scripts require network access and the CLI tools curl and jq which are not declared. The lack of declared binaries is a proportionality/visibility issue — the runtime needs these tools but the metadata doesn't inform the user.
Persistence & Privilege
The skill does not request persistent presence (always: false) and does not attempt to modify other skills or system-wide settings. It appears to be user-invokable only and does not request elevated privileges.
What to consider before installing
This skill appears to do what it claims (query public Umeå open data) and does not ask for secrets. Before installing or running it: 1) Inspect the scripts locally — especially nearby.sh and query.sh. 2) Ensure your system has curl and jq available (the skill does not declare these dependencies). 3) Note that nearby.sh references a file scripts/distance.jq which is not present in the package; running nearby.sh as-is will fail or behave unexpectedly — ask the author for the missing file or a corrected script. 4) Because the scripts make network requests to a public API, there's no credential risk, but always review third-party scripts before execution. If you need this skill to run autonomously in an agent, consider requiring explicit dependency declarations or bundling the missing helper to avoid surprises.Like a lobster shell, security has layers — review code before you run it.
latestvk97adbxaqfpcg29q0j64wwwvx5803f1e
License
MIT-0
Free to use, modify, and redistribute. No attribution required.