Teslamate Skills

Query TeslaMate vehicle data via Grafana API. Use when user wants Tesla vehicle status, battery info, drives, charges, statistics, driving score, battery hea...

This skill is functionally coherent but has important privacy/network risks you should consider before installing: it sends exact vehicle coordinates and destination addresses to external public services (Nominatim and OSRM) and the script disables TLS certificate verification for those requests (mitigates TLS failures but opens MITM risk). If you care about location privacy or operate on untrusted networks, host your own geocoding/routing services or remove/modify those calls. Also verify the grafana_url in ~/.openclaw/workspace/memory/teslamate-grafana-config.json points to your trusted Grafana instance (the script will query whatever URL is configured). If unsure, inspect and run scripts locally in a controlled environment, and consider modifying the code to enable SSL verification and to avoid calling public endpoints with raw coordinates.

Type: OpenClaw Skill Name: teslamateskills Version: 0.1.1 The skill bundle provides extensive vehicle monitoring capabilities but contains significant security vulnerabilities and high-risk behaviors. Specifically, `scripts/query_teslamate.py` explicitly disables SSL certificate verification (using `ssl.CERT_NONE`) when connecting to external geocoding (Nominatim) and routing (OSRM) APIs, exposing the agent to Man-in-the-Middle (MITM) attacks. Furthermore, the script allows for the execution of arbitrary SQL queries against the configured Grafana datasource and transmits vehicle location data to third-party services (openstreetmap.org and project-osrm.org). While these functions align with the stated purpose of the skill, the combination of disabled transport security and broad database access poses a meaningful risk to the user's environment.