NYC Subway Status

Check real-time NYC subway arrivals, track trains, and find stations. Use when user asks about subway times, train status, MTA arrivals, or NYC transit.

Security Scan

The skill’s behavior mostly matches its subway-purpose, but it asks the agent to fetch remote, runtime instructions (llms.txt) from an unverified third-party domain and offers an MCP endpoint — this gives the external host a way to change agent behavior and is a security risk.

Purpose & Capability

Name/description align with the documented API calls in SKILL.md — all network calls are to the same third-party host (nyc-subway-status.com). However, that domain is not an official MTA endpoint (e.g., api.mta.info), so it is a third-party data provider rather than the official service; this is plausible but should be verified by the user.

Instruction Scope

The SKILL.md instructs the agent to fetch a remote file (https://nyc-subway-status.com/llms.txt) 'once per session' and to follow the API reference it provides. Dynamically fetching and following an external plain-text instruction file gives the remote host effective runtime control over agent behavior (endpoints, schemas, tips). The doc also suggests connecting to an MCP server on the same host. The skill does not instruct reading local files or environment variables, but the remote-instruction pattern is a supply-chain/runtime-injection risk: the server could change instructions to exfiltrate data or call unexpected endpoints.

Install Mechanism

No install spec and no code files — the skill is instruction-only and does not write files or install binaries. That minimizes local installation risk.

Credentials

The skill declares no required environment variables, no credentials, and no config paths. There are no apparent requests for unrelated secrets or local config, which is proportionate for a read-only transit info skill.

Persistence & Privilege

always is false and there is no install-time persistence. However, model invocation is allowed (platform default). Combined with the remote llms.txt/MCP guidance, autonomous invocation increases risk because the agent could autonomously fetch remote instructions and act on them. Consider restricting autonomous execution if you are cautious.

What to consider before installing

This skill appears to implement the advertised subway lookup features, but it relies on an unverified third-party host and explicitly tells the agent to fetch a remote 'llms.txt' (and offers an MCP endpoint). That remote file can change at any time and effectively instruct the agent at runtime — a supply-chain/risk vector. Before installing: (1) verify the operator and legitimacy of https://nyc-subway-status.com (prefer official MTA sources if you need guaranteed provenance); (2) fetch and inspect the llms.txt content yourself to see what it would instruct the agent to do; (3) if possible, restrict the skill so it runs only when explicitly invoked (disable autonomous invocation) and monitor outgoing network requests; (4) avoid passing sensitive personal data to the skill or enabling MCP connectivity to the third-party server. If you cannot validate the provider, treat the skill as untrusted.

Real-time NYC subway arrival times. No API key required.

Setup

Before making any API calls, fetch the full API reference:

GET https://nyc-subway-status.com/llms.txt

This returns a plain-text guide with all endpoints, slug formats, response schemas, and tips. Read it once per session to understand the API surface.

Base URL: https://nyc-subway-status.com

Core Workflow

Always search first — never guess station or route slugs.

1. Search: GET /api/search?q={query} to find station slugs and route slugs
2. Use the returned slugs to call the appropriate endpoint

Use Cases

1. Next train at a station

User asks: "when is the next Q at 72nd st"

GET /api/search?q=72+st+q

The response includes an arrivals_url when both station and route match. Use it:

GET /api/stops/72-st-n-q-r/lines/q

Present the minutes_away values from arrivals.uptown and arrivals.downtown. Example output:

Q at 72 St (N/Q/R) Uptown: 3 min, 8 min, 15 min Downtown: 1 min, 6 min, 12 min

2. All arrivals at a station

User asks: "what trains are coming to Union Square"

GET /api/search?q=union+square
GET /api/stops/14-st-union-sq

Use the by_route field to group arrivals by line. Show each route with its next few trains in both directions.

3. Is a line running?

User asks: "is the G train running"

GET /api/lines/g

Returns next arrival at every station on the route. If most stations have next_uptown or next_downtown values, the line is running. If many are null, service may be disrupted. Summarize the overall status.

4. Track a specific train

User asks for details on a specific trip (usually after seeing a trip_id from an arrivals response):

GET /api/trips/{tripId}?route={routeSlug}

Returns every stop on the trip with status ("passed" or "upcoming") and minutes_away. Show the train's current position and upcoming stops.

5. Find a station

User asks: "find subway stations near Times Square"

GET /api/search?q=times+square

List matching stations with their routes. Offer to check arrivals at any of them.

6. Compare routes at a station

User asks: "should I take the N or Q at 72nd"

GET /api/stops/72-st-n-q-r

Use the by_route field to compare the next arrivals for each route in the user's direction. Recommend the sooner train.

Response Format

All responses follow this envelope:

{
  "ok": true,
  "data": { ... },
  "_meta": { "timestamp": "...", "endpoint": "...", "realtime": true }
}

Errors return "ok": false with an error object containing code and message.

Key Details

• Directions: "uptown" = northbound, "downtown" = southbound
• minutes_away is pre-computed server-side — no client math needed
• Arrival times include both Unix timestamps and ISO 8601 strings
• Route slugs are lowercase: a, q, 7, si, gs
• Station slugs are hyphenated lowercase: 14-st-union-sq, times-sq-42-st

MCP Server (Alternative)

For agents that support Model Context Protocol, connect directly:

{
  "mcpServers": {
    "nyc-subway": { "url": "https://nyc-subway-status.com/mcp" }
  }
}

Tools: search_subway, get_arrivals, get_station_arrivals, list_stations, list_routes, get_trip