Translink CLI

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a benign Translink transit-data helper, but it relies on separately installed external commands and discloses local cache or refresh behavior that users should verify.

Before installing, verify the external Translink CLI repository and make sure the `translink_*` commands in your PATH are trusted. Expect the skill to run those commands for transit queries and to use a local cache; only configure any scheduled refresh if you explicitly want it.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

If the external CLI scripts are not trustworthy, the agent could run untrusted local commands while using this skill.

Why it was flagged

Runtime behavior depends on separately installed external CLI scripts that are not included in the skill artifacts. This is expected for an instruction-only CLI wrapper, but provenance should be checked.

Skill content

This skill requires the Translink CLI scripts to be installed and available in PATH. - CLI repo: `https://github.com/alanburchill/traslink-cli-scripts`

Recommendation

Install the prerequisite CLI only from a repository you trust, verify the repo name and owner, and ensure the `translink_*` commands in PATH are the ones you intended.

Low

#ASI02: Tool Misuse and Exploitation

What this means

The agent may run Translink CLI commands in the local environment to answer schedule or realtime questions.

Why it was flagged

The skill lets the agent invoke local or plugin command surfaces. This is purpose-aligned for a CLI skill and the documented commands are transit-query oriented, but users should be aware that command execution is part of normal use.

Skill content

- Shell CLI: `translink_*`
- Plugin slash commands: `/translink_*` and `/translink <command> [args...]`

Recommendation

Use this skill only with trusted Translink commands installed, and review unusual command invocations if your environment prompts for approval.

Info

#ASI10: Rogue Agents

What this means

Using the underlying CLI may create or refresh local Translink cache files, and a user could optionally configure a scheduled refresh.

Why it was flagged

The artifacts disclose local caching and mention a scheduled refresh example. This appears purpose-aligned for keeping public transit data fresh, and there is no evidence the skill silently installs persistence.

Skill content

- Static cache: `~/.openclaw/cache/translink/`
- TTL: 24h
- Daily refresh cron (example): 5:00 AM local time (`translink:schedule-refresh`)

Recommendation

Only enable any cron or scheduled refresh if you want it, and check `~/.openclaw/cache/translink/` if you need to inspect or remove cached data.