BVG (Berliner Verkehrsbetriebe) Route Planner

PassAudited by VirusTotal on May 12, 2026.

Overview

Type: OpenClaw Skill Name: bvg-route Version: 0.0.2 The skill bundle is designed for Berlin public transport route planning using the v6.bvg.transport.rest API. The `SKILL.md` provides clear, non-malicious instructions for the AI agent on API interaction, with no evidence of prompt injection. The `scripts/journeys.sh` script transparently uses `curl` to query the specified public API and `jq` to process the results, employing `python3` for standard URL encoding. All components align with the stated purpose and show no signs of data exfiltration, malicious execution, persistence, or other harmful behaviors.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Your route details, such as addresses, stops, and travel times, may be sent to the BVG transport API to produce results.

Why it was flagged

The skill sends user-provided origins, destinations, and timing details to an external route-planning API. This is expected for the stated purpose, but travel locations can be privacy-sensitive.

Skill content

Resolve `from` and `to` into either stop IDs ... using GET /locations or /locations/nearby. Call GET /journeys...

Recommendation

Use the skill only for route queries you are comfortable sending to the disclosed public API; avoid highly sensitive home/work details if that is a concern.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

If you try to run the helper script directly, it may fail unless those tools are already installed.

Why it was flagged

The helper script relies on local binaries such as python3, curl, and jq, while the registry metadata declares no required binaries. This is a metadata completeness issue rather than evidence of unsafe behavior.

Skill content

urlencode() { python3 -c "import urllib.parse,sys;print(urllib.parse.quote(sys.argv[1], safe=''))" "$1"; }
...
curl -s "$url" | jq

Recommendation

Confirm python3, curl, and jq are available before using the script, or use the instruction-only workflow through the agent.