NZTA Traffic

Query real-time NZ state highway traffic conditions from the Waka Kotahi NZTA Traffic and Travel API. Use when checking road events, incidents, closures, roa...

Security Scan

The skill is coherent with its description: it queries the public Waka Kotahi traffic REST API and does not request secrets or install arbitrary code, but the package metadata omits required runtime binaries (curl, python3).

Purpose & Capability

The name/description align with the code: the script queries the trafficnz.info REST API for events, journeys, and cameras. Minor incoherence: the registry metadata lists no required binaries, but the included script invokes curl and python3 (so those are implicitly required). No unrelated credentials or services are requested.

Instruction Scope

SKILL.md and the script instruct the agent to call trafficnz.info endpoints and format results. The script does not read local files, environment variables, or system configuration beyond normal runtime, nor does it send data to endpoints other than the documented API and image URLs derived from responses.

Install Mechanism

No install spec — instruction-only with a bundled script. Nothing is downloaded from third-party URLs and no archives are extracted. Risk is limited to running the included script.

Credentials

No environment variables, credentials, or config paths are requested. The script only performs unauthenticated HTTP GET requests to the public API, which is proportionate for the stated purpose.

Persistence & Privilege

The skill does not request always:true, does not modify other skills or system configuration, and is user-invocable only. It does not persist credentials or enable itself autonomously beyond normal skill behavior.

Assessment

This skill appears to do what it says: query the public Waka Kotahi traffic API and present results. Before installing or running, note that the included script requires curl and python3 even though the metadata doesn't declare them — ensure those binaries exist and are the versions you expect. The script makes outbound requests to https://trafficnz.info (and constructs image URLs from responses); if you have network egress restrictions or a security policy about contacting external hosts, consider running the script in a restricted environment or reviewing the script locally first. No secrets or unusual permissions are requested. If you want greater assurance, verify the domain and inspect the script yourself to confirm there are no modifications or unexpected network calls.

Query the Waka Kotahi Traffic and Travel REST API for real-time state highway conditions across New Zealand.

Quick Start

Check road events for a region:

scripts/nzta-traffic.sh --region Wellington

Check a specific highway:

scripts/nzta-traffic.sh --journey 10

Check traffic cameras in a region:

scripts/nzta-traffic.sh --cameras --region Wellington

Script Usage

scripts/nzta-traffic.sh [options]

Options:
  --region <name|id>    Region name or ID (e.g. "Wellington" or "9")
  --journey <id>        Journey/highway ID (e.g. 10 for SH1 Wellington)
  --bbox <minlon,minlat,maxlon,maxlat>  Bounding box query
  --cameras             List traffic cameras instead of events
  --list-regions        List all region names and IDs
  --list-journeys       List journeys for a region (requires --region)
  --json                Output raw JSON instead of formatted summary
  --zoom <level>        Geometry zoom level, -1 for no geometry (default: -1)

Region and Journey Lookup

Run --list-regions to get region IDs, then --list-journeys --region <name> to find highway journey IDs for that region.

Common Wellington region journeys: SH1 (ID 10), SH2 (ID 9), SH58 (ID 12), SH59 (ID 341).

For full endpoint reference and response field descriptions, see references/api-endpoints.md.

Event Impact Levels

• Closed — road is closed
• Major delays — significant delays expected
• Minor delays — some delays
• Caution — be aware, proceed carefully
• Watch and observe — informational

Notes

• API base: https://trafficnz.info/service/traffic/rest/4/
• No authentication required
• Returns JSON with Accept: application/json header
• Empty response ("response": "") means no active events — that's good news