Entur Travel

• Verdict: Pass
• Analyzed: May 12, 2026, 4:28 AM
• Findings: 0
• Version: 1.0.0
• Hash: af15610c20375726cd1d93847c381a0379971a917d9cf3146cf41a2e51af6e7c
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: entur-travel Version: 1.0.0 The `scripts/entur.py` file contains GraphQL injection vulnerabilities. The `_place_arg` function and the `cmd_departures`/`cmd_stop` commands directly insert user-controlled input (`place["id"]`, `place["name"]`, `args.stop_id`) into the GraphQL query string without proper escaping of double quotes. This allows an attacker to inject arbitrary GraphQL directives or fields, potentially leading to information disclosure or denial of service against the Entur API. There is no evidence of intentional malicious behavior such as data exfiltration, backdoor installation, or unauthorized remote control; the script's purpose aligns with its stated goal of public transit planning.