travel-destination-brochure

Build travel destination scenarios and brochures from a city name. Fetches street-level and landmark imagery from OpenStreetCam and Wikimedia Commons, then uses VLM Run (vlmrun) to generate a travel video and a travel plan. Use when the user wants a travel brochure, destination guide, travel video, or travel planning for a city.

This skill appears to do what it says: fetch public images for a city, save them locally, and call the vlmrun CLI (if you provide its API key) to generate a video and itinerary. Before installing/running: 1) Avoid blindly running the suggested remote installer commands (curl | sh or PowerShell irm | iex). Prefer installing packages from your normal package manager (pip install uv) or review the install script from https://astral.sh before executing it. 2) Verify the origin and trustworthiness of the 'vlmrun' CLI/package you install (it will send image data to an external service). 3) Run the scripts inside an isolated virtual environment or sandbox to limit accidental system changes and to control network/file access. 4) Be aware images are downloaded to disk (check output directories) and may contain large files; check disk/quota. 5) If you care about privacy, note that images and the images themselves are sent to the external vlmrun service when generating video/plan; do not provide private or sensitive imagery. If you want more confidence, you can audit the Python files (they are included) and test them with --no-download or --skip-commons/--skip-osc to observe behavior without external downloads.

Type: OpenClaw Skill Name: travel-destination-brochure Version: 1.0.0 The skill bundle is classified as suspicious due to high-risk installation methods and potential prompt injection vulnerabilities. The `SKILL.md` and `README.md` files instruct the agent to install the `uv` package manager using `curl -LsSf https://astral.sh/uv/install.sh | sh` and `powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"`. These patterns involve downloading and executing arbitrary scripts from the internet, which is a significant supply chain risk. Furthermore, `SKILL.md` contains prompt injection instructions like "Check .env file for api key" and "Read .env file to find api keys", which could lead the AI agent to access and potentially expose sensitive data from the `.env` file beyond the intended `VLMRUN_API_KEY`.