Simulated Roadtrip

Generate a narrated road trip with GPS-verified stops and themed descriptions using real Google Maps data, posted in timed updates or chat.

Before installing or running: (1) Be aware you must supply a TURAI_API_KEY (SKILL.md and script require it, but the registry metadata does not list it). (2) Confirm what Turai.org actually returns and whether it uses Google Maps data if that matters to you — the script only calls Turai, not Google directly. (3) The script only prints and can save JSON; it does not automatically post to chat/social platforms — if you expect automatic posting, review or add the integration code yourself. (4) Because the source and homepage are not provided, consider running the script in a sandbox or with a limited/revocable API key first, inspect network traffic, and read the code (it's short) to verify behavior. (5) If you need stronger assurance, ask the publisher for provenance (homepage, source repo, and explanation of data sources).

Type: OpenClaw Skill Name: simulated-roadtrip Version: 1.0.1 The skill is designed to interact with the `turai.org` API to generate road trip data. The `SKILL.md` provides clear instructions and does not contain prompt injection attempts. However, the `scripts/roadtrip.mjs` file has a potential path traversal vulnerability. The `--output <path>` argument uses `node:path.resolve` to determine the output file path, which could allow a malicious user or an agent manipulated by prompt injection to write the trip data JSON to arbitrary locations on the filesystem (e.g., `../../../../tmp/evil.json`), potentially overwriting sensitive files or writing to unauthorized directories. While the intent is to save output, this capability can be misused, making it suspicious.