Map Grabber

Fetch OpenStreetMap vector data (streets, buildings) for an address and export to SVG, GeoPackage, or DXF for CAD/Rhino.

This skill appears to do what it says: it runs a local Python script that uses osmnx to geocode and download OpenStreetMap data and export images/files. Before installing, consider: (1) you must pip install osmnx (and its heavy geopandas dependencies) — that can be nontrivial on some systems; (2) the script will send the provided address to OSM geocoding/Overpass services (privacy risk for sensitive locations); (3) the SKILL.md directs the agent to execute the script without asking for extra confirmation when you ask for a map—if you prefer confirmations, change that behavior; (4) outputs must be written to allowed media dirs (/tmp or ~/.openclaw/media/) for sending via chat; (5) the code is short and readable, but if you have high security/privacy requirements, review or run it in an isolated environment before adding to a production agent.

Type: OpenClaw Skill Name: map-grabber Version: 1.1.2 The skill is classified as suspicious due to its reliance on the `shell:exec` permission to directly execute a Python script with user-provided input, combined with an explicit instruction in `SKILL.md` for the agent to "Do not ask for confirmation; execute and return the image." While the `grab_map.py` script itself appears to perform its stated function without malicious intent (e.g., no data exfiltration, backdoors, or remote execution), the direct execution of user input via `shell:exec` without confirmation presents a significant vulnerability for potential prompt injection or shell injection if the input is not properly sanitized or quoted by the agent. Additionally, the script allows writing output files (`--svg`, `--gpkg`, `--dxf`) to arbitrary paths specified by the user, which could lead to arbitrary file writes if the OpenClaw agent does not enforce path restrictions beyond the `--png` output.