Real-time phone location tracking via OwnTracks HTTP webhook receiver with named places and distance-based queries. Use when: (1) user asks "where am I?", (2...
Security Analysis
high confidenceThis skill implements a local OwnTracks HTTP receiver and a local places CLI that match its description; there are minor inconsistencies and missing documentation (port default, undocumented optional secret, and no install steps for native deps) but no signs of malicious behavior or unexplained external data exfiltration.
The code (server.mjs + places.mjs) implements an OwnTracks HTTP webhook receiver that stores latest/history JSON and a CLI backed by better-sqlite3 for named places and distance queries — this matches the skill description. The listed dependency better-sqlite3 is appropriate for the CLI. No unrelated credentials or binaries are requested.
Runtime instructions and code stay within the stated scope: accepting POSTs from OwnTracks, storing latest/history in the skill data dir, and querying that data from the CLI. The SKILL.md suggests reverse geocoding using Nominatim or web search when adding places — that implies external HTTP queries by the user/agent and should be considered normal but user-visible network activity. The systemd example requires substituting <SKILL_DIR> (user must do this).
There is no automated install spec (instruction-only install), which reduces risk. However the skill requires Node.js and the native module better-sqlite3; SKILL.md does not provide npm/yarn install instructions or build guidance for the native dependency, which is an operational omission (not a security red flag).
Metadata lists no required env vars, but the server code honors optional environment variables: OWNTRACKS_PORT, OWNTRACKS_DATA, and OWNTRACKS_SECRET. OWNTRACKS_SECRET is not documented in SKILL.md but controls an authorization Bearer token for incoming POSTs — this is not dangerous by itself but is an undocumented configuration variable and represents an inconsistency the user should be aware of. Data is stored locally in the skill data directory; no external credentials are requested.
The skill does not request permanent platform-wide inclusion. The SKILL.md recommends running the receiver as a user systemd service for persistence; that is expected behavior for a local server and the skill does not modify other skills or global agent config.
Guidance
This skill appears to implement exactly what it claims: a local OwnTracks webhook and a local places CLI. Before installing, note the following: (1) port mismatch — SKILL.md mentions port 18793 but server.mjs defaults to 18792; ensure you set OWNTRACKS_PORT consistently or update the systemd unit. (2) The server supports an optional OWNTRACKS_SECRET (Bearer token) but it's not documented in the metadata — provide a secret to protect the endpoint if you expose it on a network. (3) The CLI uses better-sqlite3, a native Node module — run npm install (or equivalent) in the skill directory and ensure build tools are available. (4) The server binds to 0.0.0.0 (listens on all interfaces) — if you expose it to a LAN, secure it with a Tailscale/host firewall or use OWNTRACKS_SECRET. (5) The skill stores location data (latest.json, history.json, and a SQLite DB) under the skill data directory; consider where you host the skill and whether that storage is acceptable for sensitive location history. If you want to proceed, correct the port in the README/systemd unit, install Node and better-sqlite3, set OWNTRACKS_SECRET if you’ll accept requests from outside localhost, and replace <SKILL_DIR> in the systemd file with the absolute path.
Latest Release
v1.0.0
Initial release of owntracks-location skill for real-time phone location tracking. - Receives OwnTracks HTTP webhooks and stores location data in SQLite. - Supports named places with a CLI for adding, searching, and distance queries. - Provides endpoints for latest location, history, and health checks. - Allows agent queries like "where am I?" and remembering user-named locations. - Requires OwnTracks app on phone, Node.js 22+, and LAN or Tailscale connectivity.
More by @globalcaos
Published by @globalcaos on ClawHub
