Travel Lobster

Autonomous internet exploration skill. Your agent roams the web driven by its own curiosity, discovers interesting things, and sends illustrated "postcards"...

This skill is internally coherent, but review and consider these practical points before installing: - Cost & volume: The skill schedules repeated autonomous trips and documents per-postcard costs (~$0.03–0.06). At default intervals (60–180m) this can become continuous daily spend and many outbound messages. Adjust min/max intervals or run in test mode first. - Local file access: setup.sh auto-reads IDENTITY.md, USER.md, and SOUL.md to personalize postcards and will create/write memory/travel-journal.md and a .travel-config in the skill dir. If those files contain sensitive info you don't want the skill to use or propagate to chat, remove or sanitize them first. - API key usage: The skill requires OPENROUTER_API_KEY for image generation. Provide a key with usage limits or monitoring (do not reuse high-privilege keys) and be aware that the key will be used by gen_image.py to call openrouter.ai. - Persistent scheduling: The skill uses openclaw cron to schedule runs and offers an optional watchdog cron entry. If you do not want long-running autonomous behavior, do not add the watchdog to system crontab and inspect cron jobs with 'openclaw cron list' before and after starting. - Inspect the scripts: The included scripts are readable shell/Python files; review them (they are short) to confirm you are comfortable with their read/write paths and logging. The image client expects a particular response format from openrouter.ai (may fail if API returns different shape), but this is an operational bug risk, not a security mismatch. - Testing recommendation: Run setup.sh and a single run of travel.sh pointing at a test/chat you control and with large min/max intervals (e.g., 1440–2880 minutes) to verify behavior, output files, and costs before enabling frequent autonomous runs. If you accept these tradeoffs (personalization via local files, one external API key, and autonomous scheduling), the skill's requests and behavior are coherent with its stated purpose.

Type: OpenClaw Skill Name: travel-lobster Version: 1.5.0 The 'travel-lobster' skill implements an autonomous, self-scheduling agent that browses the internet and maintains a persistent 'travel journal.' While the behavior is transparently documented and aligned with its stated purpose, it employs high-risk patterns including reading workspace identity files (IDENTITY.md, USER.md), autonomous web exploration, and a self-perpetuating loop where the agent is instructed to execute shell commands (scripts/travel.sh) via the platform's cron system. These capabilities create a significant attack surface for prompt injection from external web content, as the agent is directed to fetch web data and then perform shell-based scheduling. No evidence of intentional malice was found, but the autonomous shell execution and broad data access qualify it as suspicious.