Control your Tesla vehicles — lock/unlock, climate, location, charge status, and more. Supports multiple vehicles via Tesla Fleet API.
Security Analysis
high confidenceThe skill's requests and behavior are consistent with its stated purpose (remote Tesla vehicle control); it only needs your Tesla email and caches OAuth tokens locally.
Name and description match the included script and commands. The skill needs a Tesla account identifier (TESLA_EMAIL) to initiate OAuth and then uses the unofficial Tesla Owner API (via teslapy) to control vehicles, which is coherent with the claimed functionality.
SKILL.md and scripts instruct the agent to run the local Python script and perform OAuth in-browser, cache a token at ~/.tesla_cache.json, and call Tesla endpoints. There are no instructions to read unrelated system files, exfiltrate data, or contact unknown third parties.
No install spec or remote downloads are present (instruction-only with an included script). The script lists a dependency (teslapy) in comments but does not trigger any external installer; this is low-risk compared with arbitrary downloads.
Only TESLA_EMAIL is required (used to start authentication). The script caches OAuth tokens locally (~30 days) at ~/.tesla_cache.json. No unrelated secrets or extra service credentials are requested.
The skill is not forced always-on (always:false). It stores tokens under the user's home directory (its own cache file) which is expected behavior for this use case and does not modify other skills or system-wide config.
Guidance
This skill appears to do what it says: it runs a local Python script that performs OAuth with Tesla and then calls the Tesla Owner API to control vehicles. Before installing, verify you trust the skill source and review scripts/tesla.py (it will cache a refresh token at ~/.tesla_cache.json). Ensure you have or will install the Python dependency (teslapy) and that network access to Tesla endpoints is acceptable. Note: SKILL.md mentions a 'tesla-fleet-api' package but the script uses teslapy—confirm dependencies before running. Keep your machine secure because the cached token grants access to your vehicles while valid.
Latest Release
v1.3.1
Fix display name (remove Clawdbot prefix)
More by @mvanhorn
Published by @mvanhorn on ClawHub
