gotrain

• Risk level: Low
• Analyzed: May 1, 2026, 4:50 AM
• Findings: 1
• Version: 1.3.0

Overview

This skill is a coherent MTA train-time helper; the main thing to notice is that it installs and uses a third-party npm CLI globally.

This appears safe for its stated purpose of checking MTA stations, departures, and alerts. Before installing, note that it uses a global npm package, gotrain-cli, so you should be comfortable adding that third-party command to your system.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI04: Agentic Supply Chain Vulnerabilities

Low

What this means

Installing the skill may add a global command from npm to the user's system.

Why it was flagged

The skill relies on a globally installed third-party npm package to provide the gotrain command. This is consistent with the skill's purpose, but it means the user's local environment will trust that external package.

Skill content

npm install -g gotrain-cli

Recommendation

Install only if you are comfortable trusting the gotrain-cli npm package for local train-time lookups.