UK Trains
v1.0.0Query UK National Rail live departure boards, arrivals, delays, and train services. Use when asked about train times, departures, arrivals, delays, platforms, or "when is the next train" for UK railways. Supports all GB stations via Darwin/Huxley2 API.
⭐ 2· 1.9k·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description (UK live departures/arrivals via Darwin/Huxley) matches the included Python and Bash CLIs that call National Rail/Huxley endpoints. However the registry metadata claims no required env vars or binaries while the SKILL.md and scripts require NATIONAL_RAIL_TOKEN and rely on curl/jq; this mismatch is unexpected and should be corrected.
Instruction Scope
SKILL.md and the scripts instruct the agent to call the National Rail Darwin SOAP endpoint (python) or Huxley2 REST endpoint (bash) using an API token. The instructions access the environment variable NATIONAL_RAIL_TOKEN even though the registry metadata doesn't declare it. The bash script also permits overriding HUXLEY_URL via environment, which could cause network traffic (including the token) to be sent to an arbitrary endpoint if misconfigured.
Install Mechanism
There is no install spec (instruction-only), which minimizes install-time risk. The package does include executable scripts on disk; the bash script assumes presence of curl and jq but the registry did not declare these required binaries—this is a gap in declarations rather than direct malicious behavior.
Credentials
The only runtime secret required by the code is NATIONAL_RAIL_TOKEN (appropriate for calling Darwin/Huxley APIs). That is proportionate to purpose, but the skill metadata failing to declare it is a red flag. Additionally, HUXLEY_URL can be set externally; if set to an attacker-controlled URL it could receive the token and responses. No other unrelated credentials are requested.
Persistence & Privilege
The skill does not request always:true, does not modify other skills, and does not persist new credentials or write to global configuration. It runs as a CLI and makes outbound HTTP(S) calls only when invoked.
What to consider before installing
This skill appears to implement what it says (query UK train boards) but there are a few things to check before installing or enabling it:
- Expect to provide a NATIONAL_RAIL_TOKEN (Darwin API token). The registry metadata currently omits this — verify the skill will not be run without your consent. Store the token in a scoped place (skill config) rather than a broadly-shared environment variable when possible.
- The bash CLI relies on curl and jq; ensure those are available and trustworthy on the host.
- The bash script allows overriding HUXLEY_URL via the HUXLEY_URL environment variable. Do not set HUXLEY_URL to an untrusted endpoint — an attacker-controlled endpoint could receive your token and data. Prefer the default Huxley/Darwin endpoints or the Python SOAP client which calls realtime.nationalrail.co.uk directly.
- Review the scripts locally (they are provided) and test with a throwaway token first. If you need higher assurance, ask the publisher to update the registry metadata to declare required env vars (NATIONAL_RAIL_TOKEN) and required binaries (curl, jq) so the platform can surface them to users.
Because of the mismatched metadata and the endpoint-override option, treat this as suspicious until those issues are clarified.Like a lobster shell, security has layers — review code before you run it.
latestvk972d4d78ercj1s0gsnm8tqj717zwfw6
License
MIT-0
Free to use, modify, and redistribute. No attribution required.