UK Trains

Query UK National Rail live departure boards, arrivals, delays, and train services. Use when asked about train times, departures, arrivals, delays, platforms, or "when is the next train" for UK railways. Supports all GB stations via Darwin/Huxley2 API.

Security Scan

The skill's code and instructions match a UK train-board utility, but registry metadata omits required environment variables and required command-line tools, and the shell script allows overriding the API endpoint (a potential exfiltration vector).

Purpose & Capability

The name/description (UK live departures/arrivals via Darwin/Huxley) matches the included Python and Bash CLIs that call National Rail/Huxley endpoints. However the registry metadata claims no required env vars or binaries while the SKILL.md and scripts require NATIONAL_RAIL_TOKEN and rely on curl/jq; this mismatch is unexpected and should be corrected.

Instruction Scope

SKILL.md and the scripts instruct the agent to call the National Rail Darwin SOAP endpoint (python) or Huxley2 REST endpoint (bash) using an API token. The instructions access the environment variable NATIONAL_RAIL_TOKEN even though the registry metadata doesn't declare it. The bash script also permits overriding HUXLEY_URL via environment, which could cause network traffic (including the token) to be sent to an arbitrary endpoint if misconfigured.

Install Mechanism

There is no install spec (instruction-only), which minimizes install-time risk. The package does include executable scripts on disk; the bash script assumes presence of curl and jq but the registry did not declare these required binaries—this is a gap in declarations rather than direct malicious behavior.

Credentials

The only runtime secret required by the code is NATIONAL_RAIL_TOKEN (appropriate for calling Darwin/Huxley APIs). That is proportionate to purpose, but the skill metadata failing to declare it is a red flag. Additionally, HUXLEY_URL can be set externally; if set to an attacker-controlled URL it could receive the token and responses. No other unrelated credentials are requested.

Persistence & Privilege

The skill does not request always:true, does not modify other skills, and does not persist new credentials or write to global configuration. It runs as a CLI and makes outbound HTTP(S) calls only when invoked.

What to consider before installing

This skill appears to implement what it says (query UK train boards) but there are a few things to check before installing or enabling it: - Expect to provide a NATIONAL_RAIL_TOKEN (Darwin API token). The registry metadata currently omits this — verify the skill will not be run without your consent. Store the token in a scoped place (skill config) rather than a broadly-shared environment variable when possible. - The bash CLI relies on curl and jq; ensure those are available and trustworthy on the host. - The bash script allows overriding HUXLEY_URL via the HUXLEY_URL environment variable. Do not set HUXLEY_URL to an untrusted endpoint — an attacker-controlled endpoint could receive your token and data. Prefer the default Huxley/Darwin endpoints or the Python SOAP client which calls realtime.nationalrail.co.uk directly. - Review the scripts locally (they are provided) and test with a throwaway token first. If you need higher assurance, ask the publisher to update the registry metadata to declare required env vars (NATIONAL_RAIL_TOKEN) and required binaries (curl, jq) so the platform can surface them to users. Because of the mismatched metadata and the endpoint-override option, treat this as suspicious until those issues are clarified.

Query National Rail Darwin API for live train departures and arrivals.

Setup

Requires free Darwin API token:

1. Register at https://realtime.nationalrail.co.uk/OpenLDBWSRegistration/
2. Set NATIONAL_RAIL_TOKEN in environment (or configure in skills.entries.uk-trains.apiKey)

Commands

# Departures
./scripts/trains.py departures PAD
./scripts/trains.py departures PAD to OXF --rows 5

# Arrivals  
./scripts/trains.py arrivals MAN
./scripts/trains.py arrivals MAN from EUS

# Station search
./scripts/trains.py search paddington
./scripts/trains.py search kings

Station Codes

Use 3-letter CRS codes:

• PAD = London Paddington
• EUS = London Euston
• KGX = London Kings Cross
• VIC = London Victoria
• WAT = London Waterloo
• MAN = Manchester Piccadilly
• BHM = Birmingham New Street
• EDB = Edinburgh Waverley
• GLC = Glasgow Central
• BRI = Bristol Temple Meads
• LDS = Leeds
• LIV = Liverpool Lime Street
• RDG = Reading
• OXF = Oxford
• CBG = Cambridge

Response Format

JSON with:

• locationName, crs - Station info
• messages[] - Service alerts
• trainServices[] - List of trains:
  • std/sta - Scheduled departure/arrival time
  • etd/eta - Expected time ("On time", "Delayed", or actual time)
  • platform - Platform number
  • operator - Train operating company
  • destination[].name - Final destination
  • isCancelled, cancelReason, delayReason - Disruption info

Message Template

Use this compact format for WhatsApp/chat responses:

🚂 {Origin} → {Destination}

*{dep} → {arr}* │📍{platform} │ 🚃 {coaches}
{status}

*{dep} → {arr}* │📍{platform} │ 🚃 {coaches}
{status}

Elements

• Header: 🚂 emoji + origin → destination
• Time: Bold, departure → arrival times
• Platform: 📍 + number (or "TBC" if unknown)
• Coaches: 🚃 + space + number
• Status:
  • ✅ On time
  • ⚠️ Delayed (exp {time})
  • ❌ Cancelled — {reason}
  • 🔄 Starts here

Example

🚂 Hemel Hempstead → Euston

*20:18 → 20:55* │📍4 │ 🚃 4
✅ On time

*20:55 → 21:30* │📍4 │ 🚃 12
✅ On time

*21:11 → 21:41* │📍4 │ 🚃 8
✅ On time

Getting Arrival Times

To show arrival times, make two API calls:

1. departures {origin} to {dest} — get departure times + service IDs
2. arrivals {dest} from {origin} — get arrival times

Match services by the numeric prefix in serviceID (e.g., 4748110HEMLHMP_ matches 4748110EUSTON__).

Notes

• Separate each service with a blank line
• Omit coaches if formation data unavailable
• For delays, show expected time: ⚠️ Delayed (exp 20:35)