SubwaySkill
PassAudited by ClawScan on May 1, 2026.
Overview
This skill appears to do what it says: fetch NYC subway departure times using public MTA data, with only minor install and caching considerations.
This looks safe for normal use if you want subway departure lookups. Before installing, consider pinning the GitHub/Go install to a specific release or commit, and note that future-time schedule queries may download public MTA schedule files into ~/.cache/subwayskill.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent can invoke the installed subway CLI to answer transit questions.
The skill allows the agent to run the local subwayskill CLI. This is central to the stated purpose and appears scoped to the transit command.
allowed-tools: Bash(subwayskill:*)
Install only if you are comfortable letting the agent run this specific CLI for NYC transit lookups.
The reviewed code appears benign, but installing from an unpinned latest source can change what code is actually installed later.
The documented install source uses @latest rather than a pinned version, so a future install could fetch code different from the reviewed artifact snapshot.
install:\n - go: github.com/nyluke/subwayskill@latest
Prefer a pinned release or commit when installing, especially in managed or security-sensitive environments.
The tool may download and store public subway schedule data in the user's cache directory.
For scheduled departures, the code downloads public GTFS ZIP files and caches them locally. This is disclosed in the README and aligned with schedule lookup behavior.
regularGTFSURL = "https://rrgtfsfeeds.s3.amazonaws.com/gtfs_subway.zip" ... os.WriteFile(cachePath, data, 0o644)
Be aware that future-time queries may create or refresh files in ~/.cache/subwayskill.