Parses EU Digital Tachograph driver card (.ddd) files, converts to JSON, imports data into SQLite, and exports driving info and violations to CSV.

This skill appears to do exactly what it says: parse .ddd files, import into SQLite, and export CSVs. Before installing and running it: - Verify the dddparser binary source: the build guide clones https://github.com/traconiq/tachoparser. Review that repo and the built binary for trustworthiness before copying it into the skill's bin/ directory. - The skill operates on local files and the local SQLite DB only (no network exfiltration is present in the scripts), but double-check any build-time network activity (git clone) and only use trusted releases. - Be aware of retention behavior: archives are kept for 10 years and summaries for 1 year; cleanup.py will delete files accordingly. Ensure this retention matches your data‑handling and privacy policies. - process.sh can send alert emails if MAIL_TO is set and mail is available; this environment variable is optional but not listed in metadata — if you do not want emails, leave MAIL_TO unset or remove that section. - Confirm runtime environment: Python 3 is required and the dddparser binary must be present (the package does not include the compiled binary). Run the scripts in a controlled workspace (least privilege) and inspect logs/summaries after initial runs. If you want, provide the dddparser repository link or the built binary hash and I can help inspect the upstream code or compare checksums.

Type: OpenClaw Skill Name: driver-card-tachograph Version: 1.0.0 The skill bundle contains several critical security vulnerabilities that could lead to arbitrary code execution. Specifically, `scripts/process.sh` is vulnerable to Python/shell injection because it interpolates the `$JSON_OUTPUT` variable (derived from potentially untrusted filenames) directly into a `python3 -c` command string. Additionally, `scripts/export.py` and `scripts/health_check.py` utilize dangerous string formatting for SQL queries rather than parameterized inputs. While the bundle appears to serve its stated purpose of tachograph data parsing, these flaws represent a significant attack surface. The build documentation also points to an external third-party repository (github.com/traconiq/tachoparser.git) for the core binary dependency.