ruqi-mobility

如祺出行打车助手。提供实时叫车、价格预估、订单跟踪、司机位置查询、路线规划等完整出行服务。触发词："打车"、"叫车"、"去[地点]"、"回家"、"上班"、"下班"、"查价格"、"路线规划"、"怎么走"、"取消订单"、"司机"、"查订单"。

Things to check before installing: - The skill's metadata does not declare required env vars but runtime needs RUQI_CLIENT_MCP_TOKEN, RUQI_CHANNEL and RUQI_TARGET. Ask the publisher to add these to the manifest or explain why they were omitted. - The SKILL.md instructs storing API token and phone number in TOOLS.md in plaintext. Consider this sensitive data — confirm where TOOLS.md is stored, who/what can read it, and whether you are comfortable with persistent local storage of credentials. Prefer encrypted or platform-managed secrets instead of files. - The polling script opens a browser, takes screenshots, and sends messages (and possibly images) to the specified target. Make sure RUQI_TARGET points to a trusted recipient and that you consent to sharing order/driver/location info via that channel. - If you only want transient calls (queries/estimate), avoid allowing the skill to persist tokens or run background polling. Require explicit user consent before saving tokens or starting the background poll for each order. - If you need higher assurance, request the publisher to remove plaintext persistence, to document exactly what is saved to TOOLS.md, and to publish a manifest that declares required env vars and clearly explains message targets. Confidence notes: I gave 'suspicious' because the functionality itself is coherent for a ride-hailing assistant, but the undeclared env vars, plaintext credential persistence, and background screenshot/message behavior are disproportionate and warrant review. Providing the contents/location/permissions of TOOLS.md or having the publisher declare required env vars would raise confidence toward benign.

Type: OpenClaw Skill Name: ruqi-mobility Version: 1.0.2 The ruqi-mobility skill bundle is a legitimate integration for the RuQi Mobility ride-hailing service. It provides comprehensive functionality for booking rides, price estimation, and order tracking. The code follows secure practices, such as using `spawn` with `shell: false` in `scripts/request.js` to prevent shell injection and utilizing environment variables for sensitive tokens. The skill uses standard OpenClaw patterns for state persistence (storing tokens and user-defined addresses in `TOOLS.md`) and notifications (using the `openclaw` CLI to send status updates and screenshots in `scripts/ruqi_poll_with_screenshot.js`). All network activity is directed to official RuQi Mobility domains (ruqimobility.com), and no evidence of malicious intent or unauthorized data exfiltration was found.