Back to skill
Skillv1.0.0
VirusTotal security
SubwaySkill · External malware reputation and Code Insight signals for this exact artifact hash.
Scanner verdict
BenignApr 30, 2026, 4:06 AM
- Hash
- 87f0929f8db0832754e90167cef5a823b2cc89368d0cde5ff8a1dcf65ac7cf5e
- Source
- palm
- Verdict
- benign
- Code Insight
- Type: OpenClaw Skill Name: subwayskill Version: 1.0.0 The OpenClaw AgentSkills skill bundle for 'subwayskill' is benign. The `SKILL.md` and `README.md` provide clear, non-malicious instructions for the agent and users, defining the skill's purpose and usage without any prompt injection attempts. The Go source code implements a CLI tool that fetches NYC subway departure times from legitimate MTA GTFS-RT API endpoints and static GTFS data hosted on MTA S3 buckets (hardcoded URLs in `internal/feed/feed.go` and `internal/schedule/schedule.go`). It caches downloaded GTFS zip files in `~/.cache/subwayskill/` with appropriate permissions. All user inputs are validated or sanitized, and there is no evidence of shell injection, arbitrary code execution, sensitive data exfiltration, persistence mechanisms, or obfuscation. The code strictly adheres to its stated purpose.
- External report
- View on VirusTotal