腾讯出行服务打车skills
v1.0.1腾讯出行服务叫车助手。处理“帮我叫车”“我下班了，帮我叫车”“我要从亚洲金融大厦去腾讯总部”这类请求。关键词："打车"、"叫车"、"去[地点]"、"回家"、"上班"、"下班"、"司机"、"订单"、"查询订单"。注意：即使用户未明确说"打车"，只要涉及从A地到B地、通勤、或交通方式选择，都应触发。不触发场景：开发打...
⭐ 2· 43·0 current·0 all-time
by腾讯开源@tencent-adm
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the delivered assets: SKILL.md documents a ride-hailing workflow and the package includes two Python scripts and detailed API/flow docs. The skill stores a token in ~/.config/tms-takecar/env.json and persists state/addresses to ~/.config/tms-takecar/*.json, which is coherent with a call-and-order assistant. No unrelated cloud credentials or surprising binaries are requested.
Instruction Scope
Runtime instructions require invoking the bundled CLI (python3 ./scripts/tms_takecar.py) for preflight, poi-search, estimate-price, create-order, etc. The SKILL.md explicitly tells the agent to read/write files in ~/.config/tms-takecar and to persist a user token; it also enforces strict templated replies. These actions are within the stated purpose but do involve reading and writing local config and making network calls — users should expect local persistence of addresses, token, orderId, and state.
Install Mechanism
There is no install spec in the registry (instruction-only install), which is low risk. The SKILL.md may instruct helping the user install Python if it's missing; that is a system-level change initiated only with user consent and is separate from manifest-level installs.
Credentials
The skill does not request environment variables or external credentials in the manifest; authentication relies on a user-provided token stored in ~/.config/tms-takecar/env.json via the save-token command. Persisting a token and local address data is proportional to the skill's purpose but is sensitive — the token grants API access and should be treated like a secret.
Persistence & Privilege
The skill writes and reads multiple files under the user's home (~/.config/tms-takecar: env.json, state.json, addr.json, short-cut.json) and may create/overwrite those files as part of normal flows. always:false (not force-installed) and autonomous invocation is allowed by default. Writing these user-level config files is expected for this skill but is a persistent capability the user should be aware of.
Assessment
This skill is coherent with a ride-hailing assistant but it will: (1) store a user token and address/order state in ~/.config/tms-takecar, (2) run bundled Python scripts that make network requests to Tencent endpoints (default base URL: test.weixin.go.qq.com), and (3) may ask to help install Python if your system lacks it. Before installing, consider: only provide a token if you trust the service and the environment where files will be written; review the included scripts if possible (scripts/tms_takecar.py and scripts/tms_takecar_api.py) or run the skill in a sandboxed environment; do not save the token on a shared machine; and be aware the skill will persist personal addresses and order identifiers locally and interact with remote APIs.Like a lobster shell, security has layers — review code before you run it.
latestvk976wwz0kqgahs9jmjc8ab8jbh84vqpm
License
MIT-0
Free to use, modify, and redistribute. No attribution required.