London public transport journey planner and disruptions

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI07: Insecure Inter-Agent Communication

What this means

Your travel query, including locations and time, is shared with TfL to produce the journey plan.

Why it was flagged

The skill sends the user's origin, destination, date, and time to TfL's external API as part of its core journey-planning function.

Skill content

Call: `/Journey/JourneyResults/{from}/to/{to}?date=YYYYMMDD&time=HHMM&timeIs=Depart|Arrive`

Recommendation

Use it only for journey details you are comfortable sending to TfL, and avoid overly precise personal locations if that matters to you.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

If you configure TfL API credentials, they will be used for requests to TfL.

Why it was flagged

The helper can read optional TfL API credentials from the environment and include them in TfL request parameters.

Skill content

app_id = os.environ.get("TFL_APP_ID")
app_key = os.environ.get("TFL_APP_KEY")
params["app_key"] = app_key

Recommendation

Only set TfL API credentials you intend this skill to use, and treat those environment variables as sensitive.