Tessie Tesla Control

Control and monitor your Tesla vehicles via Tessie API for battery, climate, charging, drives, location, and vehicle state management.

What to check before installing: - Metadata mismatch: The skill bundle/metadata did not declare required environment variables or config paths, but SKILL.md and tessie.sh expect TESSIE_API_KEY and read ~/.clawdbot/clawdbot.json. Treat that mismatch as a red flag and ask the author to correct the metadata. - Config access: The script reads your Clawdbot config file. Verify that this file does not contain other credentials you don't want the skill to access, or ask for a version that accepts the API key via a single dedicated environment variable only. - Potential PII leakage: Some error branches print full API responses (Response: $RESULT). Ask the maintainer to remove or make this gated behind a --verbose flag to avoid leaking location/vehicle metadata. - Missing declarations and deps: The script uses jq and curl (and possibly other helper functions referenced but not defined). Ensure those tools are available and request a complete, syntax-checked script (some functions like validate_number/get_vehicle_id appear undefined in the provided fragment). - Test in isolation: If you decide to proceed, run the skill in a sandboxed environment or with a limited/test Tessie account and review network traffic and stdout to confirm no unexpected data exfiltration. If the author cannot (or will not) correct the metadata, remove debug prints, and confirm precise file access, consider classifying this skill as untrusted.

Type: OpenClaw Skill Name: tessie Version: 2.0.3 The OpenClaw AgentSkills skill bundle for Tessie is classified as benign. The `SKILL.md` file provides clear, non-malicious instructions and usage examples without any prompt injection attempts. The `tessie.sh` script securely handles API keys, validates all user inputs, constructs JSON payloads safely using `jq -n --arg`, and makes API requests exclusively to `https://api.tessie.com` via `curl` with appropriate security flags. The `SECURITY_AUDIT.md` further confirms these secure practices, highlighting that minor PII exposure in error messages was addressed, and no other significant vulnerabilities were found. The skill's actions are entirely aligned with its stated purpose of controlling Tesla vehicles.