BusLah - Singapore Bus Arrivals
PassAudited by ClawScan on May 1, 2026.
Overview
This bus-arrival skill is purpose-aligned and low risk, though it sends route locations to public transport/geocoding APIs and has minor dependency metadata mismatches.
This skill appears safe for normal bus-arrival lookups. Before installing, note that route locations such as home or office may be sent to OneMap and busrouter/arrivelah services, and the included script expects curl and jq even though the registry metadata does not fully declare those dependencies.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Your typed travel locations may be sent to public third-party APIs to perform the lookup.
The skill sends user-provided source and destination locations to external APIs. This is clearly disclosed and necessary for bus routing, but locations such as home or office can be sensitive.
Use web_fetch to resolve the source location to coordinates via OneMap API ... Same as Step 1 for the destination.
Use the skill only with locations you are comfortable sending to the listed services, especially if using home, office, or other sensitive addresses.
If the script is used, it may fail unless curl and jq are installed, despite the registry not declaring them.
The included script depends on jq and curl, while the registry declares no required binaries and SKILL.md only declares curl. This is a dependency metadata gap, but the commands are purpose-aligned and only query the bus-arrival API.
STOP=$(jq -r '.defaultStop' "$CONFIG") ... RESPONSE=$(curl -s "${API_URL}/?id=${STOP}")Treat curl and jq as required if you intend to use the included shell script; maintainers should update the registry metadata to match the actual dependencies.