Travel Itinerary Builder

Comprehensive travel itinerary generator that creates detailed, multi-day trip plans with automatic weather forecasts, points of interest, restaurant recomme...

This skill appears to do what it says, but it interacts with external services and CLIs so take these precautions before installing: (1) Review the brew formulas 'gogcli' and 'steipete/tap/goplaces' to ensure they come from trusted sources; (2) Only provide GOG_KEYRING_PASSWORD or a GOOGLE_PLACES_API_KEY if you trust the CLIs—Gmail parsing reads email content and stores extracted bookings locally as JSON; (3) Network calls are expected (wttr.in for weather, Google Places or goplaces for POIs, gog CLI for Gmail); consider running the skill inside a container/VM if you want to isolate it; (4) After use, revoke any OAuth tokens/credentials you supplied if you no longer need them; (5) If you require higher assurance, inspect the included scripts (gmail_parser.py, places_fetcher.py, weather_fetcher.py, generate_itinerary.py) yourself or run them in a sandboxed environment.

Type: OpenClaw Skill Name: travel-itinerary-builder Version: 1.0.2 This skill is classified as suspicious due to its explicit access to sensitive Gmail data via the `gog` CLI (`scripts/gmail_parser.py`) and its reliance on external CLI tools (`gog`, `goplaces`, `curl`). Furthermore, the installation of `goplaces` from a third-party Homebrew tap (`steipete/tap/goplaces`) introduces a supply chain vulnerability. While the `SKILL.md` is transparent about these capabilities and associated risks, the inherent access to personal data and the dependency on external, potentially less scrutinized, binaries warrant a 'suspicious' classification. There is no evidence of intentional data exfiltration to unauthorized endpoints or other malicious activities within the provided code.