← Back to Skills Marketplace
bgrober

alista

by Brian · GitHub ↗ · v1.1.1 · MIT-0
cross-platform ⚠ suspicious
356
Downloads
1
Stars
0
Active Installs
11
Versions
Install in OpenClaw
/install alista
Description
Save restaurants, bars, and cafes from TikTok and Instagram videos. Search your saved places and get weekend suggestions.
README (SKILL.md)

Alista - Your Restaurant Bookmark Manager

You are Alista, a friendly assistant that helps users save and rediscover restaurants, bars, and cafes they find on social media.

Personality

  • Warm and enthusiastic about food, but not over the top
  • Concise - keep responses short (2-3 sentences max)
  • Use casual language, like texting a friend
  • When saving a place, confirm with the name and a brief acknowledgment
  • When suggesting places, be specific about why each one is a good pick

Available Scripts

All scripts are in the scripts/ directory of this skill. Run them with tsx scripts/\x3Cname>.ts.

Fetch Post Metadata

Fetch raw metadata from an Instagram or TikTok post:

tsx scripts/fetch-post.ts "\x3Curl>"

Returns JSON with: caption, taggedUsers, locationName, altText, imageUrls, videoUrl, transcript, etc.

Options:

  • --download-images \x3Cdir> — Download post images locally for visual analysis
  • --extract-frames \x3Cdir> — Extract key frames from video (requires ffmpeg); only processes URLs from whitelisted CDN hosts (cdninstagram.com, tiktokcdn.com, etc.)

Manual Save

Save a place by name (verifies with Google Places):

tsx scripts/save-place.ts --name "Place Name" --city "City" --category restaurant --verify

Categories: restaurant, bar, cafe, event

Look Up a Place

Verify a place exists without saving:

tsx scripts/lookup-place.ts --name "Place Name" --city "City"

Search Saved Places

Search your saved places:

tsx scripts/search-places.ts --query "coffee" --type cafe --limit 5

List All Places

List everything you've saved:

tsx scripts/search-places.ts --list

Get Suggestions

Get weekend suggestions based on your saved places:

tsx scripts/nudge.ts --count 3

Conversation Flows

When user shares a social media URL

  1. Run fetch-post.ts with the URL to get raw post metadata
  2. You reason about the metadata to identify places:
    • Check taggedUsers — in listicle/carousel posts, tagged accounts are often the featured places
    • Check caption — look for place names, addresses, city mentions
    • Check altText — Instagram auto-generates descriptions that often contain place names and neighborhoods
    • Check locationName — the tagged location (but verify it makes sense in context)
    • If text data is insufficient, use --download-images \x3Cdir> and analyze the images visually
    • For video posts, use --extract-frames \x3Cdir> (needs ffmpeg) or check transcript field
  3. Save all verified places and immediately tell the user what was saved. For each place:
    • Run save-place.ts --verify to verify and save in one step
  4. Show the user what was saved (name, neighborhood/address, category) so they can review
  5. The user can reply to remove any they don't want — only act on removals, not approvals

When user asks to save a place by name

  1. Run save-place.ts --name "..." --city "..." --verify
  2. If verified: "Saved [Place Name] in [City]!"
  3. If not found: "I couldn't verify [Name]. Want me to save it anyway?"

When user asks "what should I try this weekend?"

  1. Run nudge.ts --count 3
  2. Present suggestions with brief reasons (urgency, freshness, variety)

When user searches ("any good coffee spots?")

  1. Run search-places.ts --query "coffee" --type cafe
  2. Present results as a numbered list

When user asks to see their list

  1. Run search-places.ts --list
  2. Present as numbered list grouped by category

Error Handling

  • If fetch-post returns no useful data: "I couldn't pull any info from that link. What's the place called?"
  • If Google Places can't verify: "I couldn't find [Name] on Google Maps. Want me to save it as-is?"
  • If no saved places: "You haven't saved any places yet! Share an Instagram or TikTok link to get started."

Data Storage

All data is stored locally in alista.db (SQLite). No cloud services needed for storage. The database is created automatically on first use.

Usage Guidance
This skill appears to implement what it says, but take these precautions before installing: - Resolve the metadata mismatch: confirm with the publisher whether APIFY_API_KEY and GOOGLE_PLACES_API_KEY are required (SKILL.md and code expect them). Do not assume 'no env vars' from the registry summary. - Inspect package-lock.json vs package.json: the lockfile contains @ai-sdk/google and ai which are not in package.json — verify this is intentional. If you will run npm install, prefer npm ci with the exact lockfile in an isolated environment (container or VM) and review the dependency tree (npm ls) first. - Limit API key scope: create and supply least-privilege API keys (restrict Google key to Places API usage and restrict Apify key usage/quotas) and consider rotating keys after testing. Never reuse high-privilege credentials. - Run in sandbox: execute the skill in a disposable VM/container to ensure it only accesses the declared hosts. Check outgoing hosts (places.googleapis.com, api.apify.com, Instagram/TikTok CDNs) and watch for unexpected network activity. - Review the full package-lock and code locally for any unexpected remote endpoints or dynamic code loading before trusting inputs or providing credentials. If the owner/publisher is unknown and you cannot validate the dependency mismatch, prefer caution (sandboxed testing or decline to install).
Capability Analysis
Type: OpenClaw Skill Name: alista Version: 1.1.1 The 'alista' skill bundle is a legitimate restaurant bookmarking tool that extracts metadata from Instagram and TikTok URLs. It uses well-known APIs (Apify and Google Places) and stores data in a local SQLite database using parameterized queries to prevent SQL injection. While it utilizes high-risk capabilities like 'ffmpeg' for video frame extraction (in 'scripts/fetch-post.ts'), it implements robust security safeguards, including URL whitelisting for media hosts and path traversal checks for file downloads. The agent instructions in 'SKILL.md' are strictly aligned with the stated purpose and include user-centric safety flows.
Capability Assessment
Purpose & Capability
The skill’s name, README, SKILL.md, and code implement exactly the described functionality: fetch post metadata (Apify / OG / oEmbed), optionally download images / extract frames (ffmpeg), verify via Google Places, and store locally in SQLite. However, registry metadata (top-level summary) says 'Required env vars: none' while SKILL.md and code require APIFY_API_KEY and GOOGLE_PLACES_API_KEY — this metadata mismatch is an incoherence that should be resolved.
Instruction Scope
SKILL.md and the scripts constrain actions to the stated purpose: fetching post metadata, optional image download (to a cwd subdirectory only), optional frame extraction via ffmpeg (only for whitelisted CDN hosts), Google Places verification, and local SQLite storage. The instructions do not direct reading of unrelated secrets or system files. The use of child_process to run ffprobe/ffmpeg is expected for frame extraction and the code includes host checks and download-dir path checks.
Install Mechanism
There is no install spec (lower risk in principle) but a package-lock.json is present and it contains packages not listed in package.json (top-level package-lock lists @ai-sdk/google and ai, while package.json dependencies are limited). That mismatch is suspicious because installing from the included lockfile could pull additional packages that are not obvious from package.json. No remote download URLs are present, which is good, but you should verify package-lock integrity and the intended dependency graph before running npm install.
Credentials
The runtime requires two external API keys (APIFY_API_KEY and GOOGLE_PLACES_API_KEY), which are proportionate to its functionality (Apify for scraping post metadata; Google Places to verify establishments). The concern is the conflicting metadata: registry summary lists no required env vars while SKILL.md and code require these keys. That discrepancy could mislead users into running the skill without realizing it will attempt network calls using provided credentials.
Persistence & Privilege
The skill does not request elevated or persistent system-wide privileges. Database storage is local (alista.db in working directory). Flags show always:false and no config paths or primary credential are requested. The skill does not modify other skills or system-wide agent settings.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install alista
  3. After installation, invoke the skill by name or use /alista
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.1.1
fix: soften SKILL.md language to address ClawHub trust flags
v1.1.0
Auto-save flow: places are verified and saved automatically when a URL is shared. User only intervenes to remove.
v1.0.0
v1.0.0: Major cleanup - removed legacy extraction scripts, simplified architecture
v0.3.0
Security hardening: fix path traversal, SQL injection, URL validation, shell injection, bun/tsx consistency
v0.2.3
Fix ClawHub security scan: remove bun shebang, fix env var validation consistency, clarify legacy script requirements
v0.2.2
Fix: use execFileSync for ffmpeg/ffprobe to prevent shell injection
v0.2.1
Updated README and docs for v0.2.0 architecture
v0.2.0
Agent-driven extraction: new fetch-post.ts returns raw Apify metadata, agent reasons about places instead of Gemini heuristics. Supports --extract-frames for video analysis. Fixed fuzzy matching with accent transliteration + token overlap. GOOGLE_API_KEY now optional.
v0.1.2
Fix fuzzy matching: transliterate accented chars instead of stripping, add token overlap scoring for short-name matches
v0.1.1
Declare external API network usage (Google Gemini, Google Places, Apify) in metadata; remove stale bun devDependency
v0.1.0
Initial release: save restaurants from Instagram/TikTok, search, suggestions via Google Places
Metadata
Slug alista
Version 1.1.1
License MIT-0
All-time Installs 0
Active Installs 0
Total Versions 11
Frequently Asked Questions

What is alista?

Save restaurants, bars, and cafes from TikTok and Instagram videos. Search your saved places and get weekend suggestions. It is an AI Agent Skill for Claude Code / OpenClaw, with 356 downloads so far.

How do I install alista?

Run "/install alista" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is alista free?

Yes, alista is completely free, licensed under MIT-0. You can download, install and use it at no cost.

Which platforms does alista support?

alista is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created alista?

It is built and maintained by Brian (@bgrober); the current version is v1.1.1.

💬 Comments