台灣即時停車查詢

傳送定位點或 Google Maps 網址，查詢附近台灣停車場即時空位，附 Apple Maps / Google Maps 一鍵導航連結。支援 Telegram、LINE、iMessage。

This skill is internally consistent: it needs only TDX credentials to call the official TDX APIs and the code matches the documentation. Before installing, do these quick checks: (1) Only supply TDX_CLIENT_ID and TDX_CLIENT_SECRET (do not reuse other secrets). (2) Inspect and trust the GitHub repo referenced by update.sh (https://github.com/Harperbot/openclaw-parking-query) before running update.sh or enabling any automated update cron jobs — the script will download and overwrite the skill files. (3) Note that resolving Google short URLs performs an HTTP HEAD with redirects (normal for expanding short map links), so if you pass unfamiliar external URLs be aware the skill will follow redirects to whatever upstream target is returned. If you are comfortable trusting the GitHub source and the TDX service, the skill appears safe to use.

Type: OpenClaw Skill Name: openclaw-parking-query Version: 1.0.0 The `skill.yml` file contains a shell injection vulnerability (Remote Code Execution risk) in the `run` command definition. The user-controlled `url` parameter, typed as a string, is directly interpolated into a shell command: `--url "${url}"`. While double-quoted, this can still be exploited by an attacker using command substitution (e.g., `"$(id)"`) to execute arbitrary commands on the host running the OpenClaw agent. This is a critical vulnerability, but it represents a flaw allowing attacks rather than clear evidence of intentional malicious behavior by the skill's author.