railil - Israel Railways train station schedule

• Risk level: Low
• Analyzed: May 1, 2026, 4:50 AM
• Findings: 1
• Version: 1.0.1

Overview

This skill coherently wraps a train-schedule CLI and does not show suspicious behavior, though it installs a third-party npm package globally.

This appears safe for its stated purpose of looking up train schedules. Before installing, be aware that it globally installs the external railil npm package; use it if you trust that package source and want the CLI available on your system.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI04: Agentic Supply Chain Vulnerabilities

Note

What this means

Installing the skill adds an external CLI package to the user's system, so its behavior depends on the npm package that is installed.

Why it was flagged

The skill depends on installing a third-party npm package globally. This is expected for a CLI-wrapper skill, but the install command is not version-pinned.

Skill content

npm install -g railil

Recommendation

Install only if you trust the railil npm package and homepage; consider pinning or verifying the package version in controlled environments.