Railil

PassAudited by ClawScan on May 1, 2026.

Overview

This instruction-only skill coherently installs and uses the Railil CLI for train schedule searches, with no credentials, persistence, or unrelated authority shown.

This appears safe for its stated purpose. Before installing, make sure you are comfortable installing the `railil` npm package globally; the provided skill instructions otherwise only use it to look up train schedules.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the skill may require adding a global npm CLI tool to the user's environment.

Why it was flagged

The skill relies on installing a third-party npm package globally to provide the `railil` CLI binary. This is purpose-aligned and disclosed, but it means the user must trust that package.

Skill content

npm install -g railil

Recommendation

Install only if you trust the `railil` npm package and its linked project; keep the package updated through normal npm maintenance.