MTA Commuter

PassAudited by ClawScan on Apr 17, 2026.

Overview

The skill appears to do what it claims (MTA schedule/trip planning) and its code, dependencies, and runtime instructions are consistent with that purpose, with a few operational/privacy notes to consider.

This skill looks like a straightforward, coherent MTA transit tool, but review a few practical points before installing: 1) Privacy: saved addresses are written to skills/mta/data/locations.json — treat that file as sensitive. The setup step says to 'geocode via web search', which will expose addresses to whatever geocoding/web service the agent uses. 2) Track watch uses undocumented endpoints (backend-unified.mylirr.org and backend-unified.mymnr.org) — the skill documents this; these endpoints may change or be rate‑limited. Running frequent cron polling (examples show every 20s) will generate repeated network requests; lower the frequency if you’re concerned about load or hitting rate limits. 3) Feeds: some GTFS‑RT endpoints in feeds.json point at api-endpoint.mta.info — these can require an MTA API key in other contexts; if real‑time data appears missing, confirm whether your environment/platform needs an API key or headers. 4) Run tests and inspect scripts if you want to be cautious: network calls are made with urllib (gtfs downloads, GTFS‑RT, alerts, track endpoints). If you rely on notification channels (Telegram via openclaw cron), ensure those channels are configured securely. If you want me to, I can: list every external URL the skill contacts, show where locations.json is read/written, or highlight all places the skill performs network I/O.