TfL London Transit

PassAudited by ClawScan on May 10, 2026.

Overview

This appears to be a read-only TfL transit lookup skill; it uses an optional TfL API key and sends user transit queries to TfL, which is expected for its purpose.

This skill looks reasonable for London transit lookups. Before installing, be aware that it may send your transit searches and any supplied coordinates to TfL, and that an optional TFL_API_KEY will be included in TfL API requests for higher rate limits.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

If you configure a TfL API key, the key is used for TfL requests to increase rate limits.

Why it was flagged

The skill uses an optional provider API key and sends it to the stated TfL endpoint as an app_key query parameter.

Skill content

const TFL_API_KEY = process.env.TFL_API_KEY || ''; ... ? `${TFL_BASE}${endpoint}${sep}app_key=${encodeURIComponent(TFL_API_KEY)}`

Recommendation

Use a TfL-specific API key, avoid putting unrelated secrets in the skill’s .env file, and rotate the key if it is accidentally exposed.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

TfL may receive station names, routes, or coordinates that you ask the agent to use for transit planning.

Why it was flagged

Journey planning requires sending the user’s origin and destination to the external TfL API.

Skill content

`/Journey/JourneyResults/{from}/to/{to}` | Journey planning

Recommendation

Avoid submitting precise or sensitive locations if that privacy tradeoff is unacceptable; use general station names where possible.