TripGo API

Comprehensive interface for the TripGo API, covering routing, public transport, trips, and location services. Use for multimodal journey planning, public tra...

This skill appears to be a straightforward TripGo API wrapper. Before installing: 1) Only provide a TripGo API key you control (do not reuse other service credentials). 2) If you plan to use webhook registration, set TRIPGO_WEBHOOK_ALLOWLIST to restrict allowed callback domains and avoid setting TRIPGO_ALLOW_UNSAFE_WEBHOOK to true in production. 3) Review the included scripts if you will run them on your host, and ensure curl and jq (and python3 if you rely on pretty-printing) are present. 4) Be aware the skill will make network requests to the configured TripGo base URL and any webhook URLs you register; only register trusted callback endpoints. 5) If you want to prevent autonomous invocation, adjust agent settings (note: disable-model-invocation is false by default on the platform).

Type: OpenClaw Skill Name: tripgo-api Version: 1.0.1 The skill bundle is benign. It provides a comprehensive interface to the TripGo API using standard shell scripting practices. All scripts correctly handle API keys via environment variables, use `jq` for safe JSON construction and validation, and `jq` for URL encoding, effectively preventing command and shell injection. Network calls are consistently directed to the legitimate TripGo API base URL. The webhook registration functionality, while inherently a high-risk capability, includes explicit security controls such as HTTPS enforcement and a configurable domain allowlist (`TRIPGO_WEBHOOK_ALLOWLIST`), demonstrating a clear intent to mitigate exfiltration risks. There is no evidence of malicious intent, data exfiltration to unauthorized endpoints, persistence mechanisms, or prompt injection attempts in the `SKILL.md`.