Arrivelah

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a simple bus-arrival helper that only queries the disclosed Arrivelah API using the configured bus stop.

This skill looks coherent and low risk. Before installing, check that config.json contains the correct bus stop and that you are comfortable sending that stop code to the disclosed Arrivelah API.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

Your configured bus stop code is sent to the Arrivelah API when the lookup runs.

Why it was flagged

The skill uses curl to call the configured external API with the saved bus stop code. This is disclosed and purpose-aligned for bus arrival lookup, but users should know a location-related stop code is sent externally.

Skill content

RESPONSE=$(curl -s "${API_URL}/?id=${STOP}")

Recommendation

Only configure stops you are comfortable querying through the disclosed API, and keep the apiUrl pointed at the intended Arrivelah endpoint.