ClawHub

Capmetro Skill

v1.0.3

Austin CapMetro transit - real-time vehicle positions, next arrivals, service alerts, route info, and trip planning for buses and rail (MetroRail, MetroRapid...

⭐ 0· 683·0 current·0 all-time
byBrian Leach@brianleach
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description (CapMetro transit data) match the included files and runtime behavior. The script fetches GTFS and GTFS-RT feeds from the Texas Open Data Portal, parses protobuf/JSON feeds, and uses GTFS static files for stop/route lookups. Required binaries (node, unzip) are reasonable for a Node.js script that downloads and extracts a ZIP.
ℹ
Instruction Scope
SKILL.md and README instruct the agent/user to run npm install and to run the included node script and refresh-gtfs. The runtime instructions are narrowly scoped to fetching/parsing CapMetro feeds and caching GTFS in ~/.capmetro/gtfs. The skill documentation and the script explicitly state there are no env vars or other system-wide reads. Note: the skill will write files under the user's home directory (~/.capmetro/gtfs) and will make outbound GET requests to data.texas.gov; this is expected but worth noting.
ℹ
Install Mechanism
There is no automated registry install spec, but SKILL.md (and the README) instructs running npm install (or an inline npm install --prefix $SKILL_DIR protobufjs). The package.json declares protobufjs as a dependency and package-lock.json references public npm packages — this is proportionate. The script uses the system 'unzip' via execFileSync to extract the downloaded GTFS ZIP; the feed URL is data.texas.gov (a well-known public host). Minor caution: extracting remote archives with system unzip (-o) can overwrite files; the code writes into ~/.capmetro/gtfs and does not validate archive contents for path traversal or unexpected filesystem writes, which is a generic risk when extracting remote archives but consistent with the skill's purpose.
✓
Credentials
The skill declares no required env vars or credentials and the code does not read credentials. All external endpoints are the Texas Open Data Portal URLs listed in SKILL.md and the script comments. There are no unexpected secrets requested.
✓
Persistence & Privilege
The skill is not always-included and can be invoked by the user or the agent. It persists cached GTFS files under the user's home directory (~/.capmetro/gtfs) which is reasonable for this use. It does not modify other skills or global agent configuration.
Assessment
This skill appears to do what it claims: fetch public CapMetro GTFS/GTFS-RT data and present arrivals/vehicle positions. Before installing, confirm you trust the source (the GitHub repo listed) and that you're comfortable with these practical points: (1) it requires Node.js and the system 'unzip' binary and will run npm install (protobufjs) in the skill directory; (2) it will download and extract a GTFS ZIP into ~/.capmetro/gtfs and will overwrite files there when refreshing (the script uses unzip -o); (3) it only makes read-only GET requests to data.texas.gov (no credentials required). If you want extra caution, review the full scripts/capmetro.mjs file locally or run the skill in a sandboxed environment; optionally inspect the GTFS ZIP contents before extraction or modify the script to validate zip entries.

Like a lobster shell, security has layers — review code before you run it.

latestvk97br07gfhemf8g381mhrmw2gs827v49

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🚌 Clawdis
Binsnode, unzip

Comments