← 返回 Skills 市场

Control your vehicle from AI agent

Name: Control your vehicle from AI agent
Author: lkisme

作者 Kuikui · GitHub ↗ · v1.1.1 · MIT-0

cross-platform ⚠ suspicious

102

总下载

当前安装

版本数

在 OpenClaw 中安装

/install carkey

功能描述

车辆信息查询技能。查询车辆位置、车况（车锁、车门、车窗、空调、电源状态等）。触发词：查车、车辆位置、车况、我的车在哪。跨平台支持 Linux/macOS/Windows。

使用说明 (SKILL.md)

何时使用

用户查询车辆位置："我的车在哪"、"查一下车在哪"
用户查询车况信息："车锁了吗"、"车窗关了吗"、"车辆状态"
用户需要提供认证信息时，引导输入 vehicleToken####accessToken

快速使用

方式 1：绝对路径（推荐 Agent 使用）

# 假设技能安装在 ~/.openclaw/workspace/skills/carkey
~/.openclaw/workspace/skills/carkey/scripts/vehicle-query.sh
~/.openclaw/workspace/skills/carkey/scripts/vehicle-query.sh position
~/.openclaw/workspace/skills/carkey/scripts/vehicle-query.sh condition

方式 2：相对路径（用户手动执行）

cd carkey
./scripts/vehicle-query.sh
./scripts/vehicle-query.sh position
./scripts/vehicle-query.sh condition

认证

格式： vehicleToken####accessToken（4 个 # 分隔）

首次使用会提示输入，自动缓存。

系统	缓存路径
Linux/macOS	`~/.carkey_cache.json`
Windows	`%USERPROFILE%/.carkey_cache.json`

状态码

字段	值含义
power	0=熄火, 1=ACC, 2=ON
gear	1=P, 2=N, 3=D, 4=R, 5=S
door/window/trunk	0=关闭, 1=开启
lock	0=解锁, 1=上锁

错误处理

场景	处理
无缓存	引导用户提供 token
Token 过期	提示重新认证，删除旧缓存
请求失败	自动重试 2 次，30 秒超时
缺少依赖	提示安装 curl/jq

系统支持

系统	依赖安装
Linux (Ubuntu/Debian)	`sudo apt-get install curl jq`
Linux (CentOS/RHEL)	`sudo yum install curl jq`
macOS	`brew install curl jq`
Windows (Git Bash)	已包含
Windows (WSL)	`wsl sudo apt-get install curl jq`

文件结构

carkey/
├── SKILL.md              # 本文档
├── README.md             # 详细说明
├── _meta.json            # 元数据
└── scripts/
    └── vehicle-query.sh  # 查询脚本（跨平台）

安全使用建议

This skill appears to do what it says: run the included script and query a vehicle API using tokens you provide. Before installing/using: (1) verify you trust the API host (https://openapi.nokeeu.com) because your tokens and vehicle data are sent there; (2) inspect the script (already included) so you understand what it posts and which local files it writes; (3) be aware tokens are cached in plaintext at ~/.carkey_cache.json (or %USERPROFILE%/.carkey_cache.json) — consider restricting file permissions (chmod 600) or deleting the cache when finished; (4) only provide tokens with minimal scope and rotate/revoke them if you suspect misuse.

功能分析

Type: OpenClaw Skill Name: carkey Version: 1.1.1 The script 'scripts/vehicle-query.sh' contains a critical shell injection vulnerability in the 'save_tokens' function, where user-provided authentication tokens are expanded within a heredoc without sanitization, potentially allowing arbitrary command execution. The skill also stores sensitive vehicle access tokens in plain text in the user's home directory ('~/.carkey_cache.json') and communicates with an obscure API endpoint ('openapi.nokeeu.com'). While the behavior aligns with the stated purpose of vehicle monitoring, these high-risk vulnerabilities and the use of an unverified domain warrant a suspicious classification.

能力评估

✓ Purpose & Capability

Name/description, SKILL.md, README, and the included script all align: the script queries a vehicle API for position and condition data using a vehicleToken/accessToken pair. No unrelated credentials, tools, or system access are requested.

✓ Instruction Scope

Runtime instructions tell the agent to run the bundled shell script and to prompt the user for a token in the specified format. The script only reads/writes its own cache/history files in the user's home, checks for curl/jq, and posts to the declared API endpoint. The instructions do not ask the agent to read arbitrary system files or exfiltrate other data.

✓ Install Mechanism

No installation downloads or third-party packages are performed by the skill bundle; it's instruction + a local shell script. There are no external installers or URL downloads in the package.

ℹ Credentials

The skill does not request environment variables or platform credentials. It requires the user to supply vehicleToken####accessToken, which is appropriate for the task. Note: the script caches those tokens in plaintext under ~/.carkey_cache.json (or %USERPROFILE% on Windows) without explicit permission tightening, and sends them to https://openapi.nokeeu.com — users must trust that external service.

✓ Persistence & Privilege

always:false and normal autonomous invocation settings. The script writes its own cache and history files under the user's home; it does not modify other skills or system-wide configs.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install carkey
安装完成后，直接呼叫该 Skill 的名称或使用 /carkey 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.1.1

- 更新「快速使用」部分，新增绝对路径与相对路径两种调用方式说明，提升使用指引清晰度

v1.1.0

Version 1.1.0 - 全面更新并补充技能文档，包含快速使用方法、认证和缓存说明。 - 明确状态码字段含义，详细列举车辆状态解释。 - 新增常见错误处理流程及处理方式说明。 - 列出各操作系统的依赖安装命令，提升跨平台适配性。 - 补充文件结构和脚本路径说明，便于用户快速定位相关文件。

元数据

Slug carkey

版本 1.1.1

许可证 MIT-0

累计安装 0

当前安装数 0

历史版本数 2

常见问题