London public transport journey planner and disruptions

PassAudited by ClawScan on May 1, 2026.

Overview

This skill appears coherent and purpose-aligned, but using it sends journey details and any configured TfL API key to TfL.

This looks safe for its stated purpose. Before using it, be aware that route queries are sent to TfL and that any TFL_APP_ID or TFL_APP_KEY environment variables you set will be used by the helper script.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Your travel query, including locations and time, is shared with TfL to produce the journey plan.

Why it was flagged

The skill sends the user's origin, destination, date, and time to TfL's external API as part of its core journey-planning function.

Skill content

Call: `/Journey/JourneyResults/{from}/to/{to}?date=YYYYMMDD&time=HHMM&timeIs=Depart|Arrive`

Recommendation

Use it only for journey details you are comfortable sending to TfL, and avoid overly precise personal locations if that matters to you.

Low

#ASI03: Identity and Privilege Abuse

What this means

If you configure TfL API credentials, they will be used for requests to TfL.

Why it was flagged

The helper can read optional TfL API credentials from the environment and include them in TfL request parameters.

Skill content

app_id = os.environ.get("TFL_APP_ID")
app_key = os.environ.get("TFL_APP_KEY")
params["app_key"] = app_key

Recommendation

Only set TfL API credentials you intend this skill to use, and treat those environment variables as sensitive.