Car Log
v1.0.0汽车里程管理助手。当用户提到"记录里程"、"记录加油"、"记录保养"、"里程"、"加油"、"保养"、"油耗"、"车辆花费"等汽车相关记录时使用此技能。
⭐ 0· 66·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description match the code and SKILL.md: the tool manages vehicles, mileage, refuels, maintenance and expense stats and stores records in a local SQLite DB (~/.car-log/car_log.db by default). The included script implements the described commands.
Instruction Scope
SKILL.md instructs running the bundled script (bun scripts/carlog.js) and describes only local database operations and CLI commands. It does not request reading unrelated system files or sending data externally. Minor inconsistency: SKILL.md claims the script is packaged as an independent binary (no bun needed) but the provided file starts with a Bun shebang and imports bun:sqlite — running it as-is likely requires Bun or a provided binary.
Install Mechanism
No install spec is provided (instruction-only), which is lowest risk. However, a code file (scripts/carlog.js) is included; executing it will write a database to the user's home directory. There are no network downloads or third‑party package installs in the manifest.
Credentials
The skill declares no required environment variables or credentials. The code reads an optional CAR_LOG_DB environment variable to override the DB path — this is reasonable for configurability but was not declared in the SKILL.md metadata. No other secrets or unrelated env access observed in the reviewed portion.
Persistence & Privilege
The skill does not request always:true and does not modify other skills. It persists a local SQLite DB under the user's home directory (expected behavior for a local logging tool).
Assessment
This skill appears coherent for a local car log manager, but before installing: (1) inspect the full scripts/carlog.js for any network calls or unexpected behavior (the provided snippet was truncated); (2) confirm whether the author truly supplies a single standalone binary as claimed — otherwise running the script requires Bun (the file uses bun:sqlite and a Bun shebang); (3) note the script will create and write to ~/.car-log/car_log.db (or to a path you set via CAR_LOG_DB); if you are uncomfortable, run it in a sandboxed environment or review the entire source for outbound network or credential access. If you need higher assurance, ask the publisher for a signed release or a build/package that matches the README claim.Like a lobster shell, security has layers — review code before you run it.
latestvk975pjz9fn9qxrhwqhx82jqz2x84d421
License
MIT-0
Free to use, modify, and redistribute. No attribution required.