Tesla China

面向中国特斯拉车主的远程控制技能，基于特斯拉官方车队 API（Fleet API）实现，使用简单、体验自然。

This skill is coherent and the code is small and readable, but it relies on a third‑party proxy (https://tesla.dhuar.com) and asks you to obtain and store an apiKey from that site. Before installing or using it: 1) Verify who runs tesla.dhuar.com and whether you trust them to receive your apiKey, VINs, and vehicle telemetry/location; 2) Prefer using official Tesla authentication if possible, or only use a revocable/dedicated key; 3) Understand that the skill will store the apiKey in ~/.tesla_cn.json (anyone with file access can read it) — consider file permissions and storing secrets in a safer vault; 4) If unsure, contact the author or run the scripts in an isolated environment and monitor outbound requests to confirm behavior; 5) If you proceed, treat the apiKey as sensitive and be prepared to revoke it if you lose trust in the proxy service.

Type: OpenClaw Skill Name: tesla-cn Version: 1.0.1 The skill manages Tesla vehicle controls by routing sensitive API keys and commands through a third-party proxy (https://tesla.dhuar.com) instead of the official Tesla API. It stores credentials in the user's home directory (~/.tesla_cn.json) and transmits the apiKey as a plaintext query parameter in the URL, which is a significant security vulnerability that exposes vehicle access to the proxy operator and network logs. While the scripts (scripts/tesla-command.js and scripts/init-tesla-config.js) perform their stated functions, the architectural choice of using an unofficial intermediary for car telemetry and control poses a high risk of credential theft or unauthorized vehicle access.