Cta Skill

PassAudited by ClawScan on May 10, 2026.

Overview

This appears to be a coherent CTA transit lookup skill that uses disclosed CTA API keys and a local transit-data cache, with no artifact-backed evidence of hidden or unrelated behavior.

This skill looks reasonable for CTA transit lookups. Before installing, be comfortable providing CTA API keys, allowing requests to CTA services, and allowing the refresh command to create a public GTFS cache under ~/.cta/gtfs. Keep the .env file limited to the CTA keys and note that the registry metadata appears to under-declare the setup requirements.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

Your CTA API keys may be used to make train and bus tracker requests and consume your provider quota.

Why it was flagged

The skill uses CTA API keys and sends requests to CTA provider endpoints. This is disclosed and purpose-aligned, but users should still treat the keys as credentials.

Skill content

Environment variables: CTA_TRAIN_API_KEY, CTA_BUS_API_KEY
External endpoints:    https://lapi.transitchicago.com (Train Tracker, key required)
                       https://www.ctabustracker.com (Bus Tracker, key required)

Recommendation

Use dedicated free CTA API keys, keep them in a local .env or environment variables, and do not put unrelated secrets in the skill's .env file.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Users relying only on registry metadata may not realize the skill needs Node.js, unzip, CTA API keys, and a setup command.

Why it was flagged

The skill manifest documents setup requirements that the registry summary reports as absent. This is under-declared setup metadata, although it is consistent with the skill's purpose and package.json shows no third-party dependencies.

Skill content

requires:
  bins: ["node", "unzip"]
  env: ["CTA_TRAIN_API_KEY", "CTA_BUS_API_KEY"]
...
install:
  - id: npm-deps
    kind: shell
    command: "npm install --prefix $SKILL_DIR"

Recommendation

Review SKILL.md before installing and ensure the registry metadata is corrected to declare the required binaries, env vars, and setup step.

Low

#ASI05: Unexpected Code Execution

What this means

Running the refresh command will create or update files under ~/.cta/gtfs using data downloaded from CTA.

Why it was flagged

The skill includes a user-directed local command that downloads and extracts public CTA GTFS data into a home-directory cache. This is documented and purpose-aligned, but it does modify local files.

Skill content

On first use, run `node scripts/cta.mjs refresh-gtfs` to download and extract the static GTFS data (routes, stops, schedules) to `~/.cta/gtfs/`.

Recommendation

Run the refresh command only when you want the local schedule cache updated, and verify it writes only to the documented ~/.cta/gtfs location.