railil - Israel Railways train station schedule
PassAudited by VirusTotal on May 12, 2026.
Overview
Type: OpenClaw Skill Name: railil Version: 1.0.1 The skill bundle defines the installation and usage of the `railil` CLI tool for checking train schedules. The `SKILL.md` instructs the agent to install the `railil` npm package globally (`npm install -g railil`). While `npm install` carries an inherent supply chain risk by executing code from an external registry, the instruction itself is standard and directly aligned with the skill's stated purpose. There is no evidence of data exfiltration, malicious execution beyond the standard package installation, persistence mechanisms, prompt injection attempts against the agent, or obfuscation within the provided files.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Installing the skill adds an external CLI package to the user's system, so its behavior depends on the npm package that is installed.
The skill depends on installing a third-party npm package globally. This is expected for a CLI-wrapper skill, but the install command is not version-pinned.
npm install -g railil
Install only if you trust the railil npm package and homepage; consider pinning or verifying the package version in controlled environments.