← Back to Skills Marketplace
102
Downloads
0
Stars
0
Active Installs
2
Versions
Install in OpenClaw
/install carkey
Description
车辆信息查询技能。查询车辆位置、车况（车锁、车门、车窗、空调、电源状态等）。触发词：查车、车辆位置、车况、我的车在哪。跨平台支持 Linux/macOS/Windows。
README (SKILL.md)
何时使用
- 用户查询车辆位置："我的车在哪"、"查一下车在哪"
- 用户查询车况信息："车锁了吗"、"车窗关了吗"、"车辆状态"
- 用户需要提供认证信息时，引导输入
vehicleToken####accessToken
快速使用
方式 1：绝对路径（推荐 Agent 使用）
# 假设技能安装在 ~/.openclaw/workspace/skills/carkey
~/.openclaw/workspace/skills/carkey/scripts/vehicle-query.sh
~/.openclaw/workspace/skills/carkey/scripts/vehicle-query.sh position
~/.openclaw/workspace/skills/carkey/scripts/vehicle-query.sh condition
方式 2：相对路径（用户手动执行）
cd carkey
./scripts/vehicle-query.sh
./scripts/vehicle-query.sh position
./scripts/vehicle-query.sh condition
认证
格式： vehicleToken####accessToken（4 个 # 分隔）
首次使用会提示输入，自动缓存。
| 系统 | 缓存路径 |
|---|---|
| Linux/macOS | ~/.carkey_cache.json |
| Windows | %USERPROFILE%/.carkey_cache.json |
状态码
| 字段 | 值含义 |
|---|---|
| power | 0=熄火, 1=ACC, 2=ON |
| gear | 1=P, 2=N, 3=D, 4=R, 5=S |
| door/window/trunk | 0=关闭, 1=开启 |
| lock | 0=解锁, 1=上锁 |
错误处理
| 场景 | 处理 |
|---|---|
| 无缓存 | 引导用户提供 token |
| Token 过期 | 提示重新认证，删除旧缓存 |
| 请求失败 | 自动重试 2 次，30 秒超时 |
| 缺少依赖 | 提示安装 curl/jq |
系统支持
| 系统 | 依赖安装 |
|---|---|
| Linux (Ubuntu/Debian) | sudo apt-get install curl jq |
| Linux (CentOS/RHEL) | sudo yum install curl jq |
| macOS | brew install curl jq |
| Windows (Git Bash) | 已包含 |
| Windows (WSL) | wsl sudo apt-get install curl jq |
文件结构
carkey/
├── SKILL.md # 本文档
├── README.md # 详细说明
├── _meta.json # 元数据
└── scripts/
└── vehicle-query.sh # 查询脚本（跨平台）
Usage Guidance
This skill appears to do what it says: run the included script and query a vehicle API using tokens you provide. Before installing/using: (1) verify you trust the API host (https://openapi.nokeeu.com) because your tokens and vehicle data are sent there; (2) inspect the script (already included) so you understand what it posts and which local files it writes; (3) be aware tokens are cached in plaintext at ~/.carkey_cache.json (or %USERPROFILE%/.carkey_cache.json) — consider restricting file permissions (chmod 600) or deleting the cache when finished; (4) only provide tokens with minimal scope and rotate/revoke them if you suspect misuse.
Capability Analysis
Type: OpenClaw Skill
Name: carkey
Version: 1.1.1
The script 'scripts/vehicle-query.sh' contains a critical shell injection vulnerability in the 'save_tokens' function, where user-provided authentication tokens are expanded within a heredoc without sanitization, potentially allowing arbitrary command execution. The skill also stores sensitive vehicle access tokens in plain text in the user's home directory ('~/.carkey_cache.json') and communicates with an obscure API endpoint ('openapi.nokeeu.com'). While the behavior aligns with the stated purpose of vehicle monitoring, these high-risk vulnerabilities and the use of an unverified domain warrant a suspicious classification.
Capability Assessment
Purpose & Capability
Name/description, SKILL.md, README, and the included script all align: the script queries a vehicle API for position and condition data using a vehicleToken/accessToken pair. No unrelated credentials, tools, or system access are requested.
Instruction Scope
Runtime instructions tell the agent to run the bundled shell script and to prompt the user for a token in the specified format. The script only reads/writes its own cache/history files in the user's home, checks for curl/jq, and posts to the declared API endpoint. The instructions do not ask the agent to read arbitrary system files or exfiltrate other data.
Install Mechanism
No installation downloads or third-party packages are performed by the skill bundle; it's instruction + a local shell script. There are no external installers or URL downloads in the package.
Credentials
The skill does not request environment variables or platform credentials. It requires the user to supply vehicleToken####accessToken, which is appropriate for the task. Note: the script caches those tokens in plaintext under ~/.carkey_cache.json (or %USERPROFILE% on Windows) without explicit permission tightening, and sends them to https://openapi.nokeeu.com — users must trust that external service.
Persistence & Privilege
always:false and normal autonomous invocation settings. The script writes its own cache and history files under the user's home; it does not modify other skills or system-wide configs.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install carkey - After installation, invoke the skill by name or use
/carkey - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.1.1
- 更新「快速使用」部分，新增绝对路径与相对路径两种调用方式说明，提升使用指引清晰度
v1.1.0
Version 1.1.0
- 全面更新并补充技能文档，包含快速使用方法、认证和缓存说明。
- 明确状态码字段含义，详细列举车辆状态解释。
- 新增常见错误处理流程及处理方式说明。
- 列出各操作系统的依赖安装命令，提升跨平台适配性。
- 补充文件结构和脚本路径说明，便于用户快速定位相关文件。
Metadata
Frequently Asked Questions
What is Control your vehicle from AI agent?
车辆信息查询技能。查询车辆位置、车况（车锁、车门、车窗、空调、电源状态等）。触发词：查车、车辆位置、车况、我的车在哪。跨平台支持 Linux/macOS/Windows。 It is an AI Agent Skill for Claude Code / OpenClaw, with 102 downloads so far.
How do I install Control your vehicle from AI agent?
Run "/install carkey" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Control your vehicle from AI agent free?
Yes, Control your vehicle from AI agent is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Control your vehicle from AI agent support?
Control your vehicle from AI agent is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Control your vehicle from AI agent?
It is built and maintained by Kuikui (@lkisme); the current version is v1.1.1.
More Skills