Skanetrafiken Trip Planner

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

A user should trust the installer and repository they use, because install-time content may differ from the reviewed package if pulled from a moving source.

Why it was flagged

The install guidance is user-directed and not automatically executed, but it references a latest installer and a remote repository rather than a pinned artifact.

Skill content

npx clawdhub@latest install rezkam/boring-but-good/skanetrafiken
...
git clone https://github.com/rezkam/boring-but-good.git

Recommendation

Prefer installing the reviewed registry version or a pinned release/commit, and verify that curl and jq are installed.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Trip searches may reveal personal location or travel-intent details to the transport API provider.

Why it was flagged

Journey origins, destinations, types, and optional times are sent to Skånetrafiken's API, which is necessary for the stated trip-planning function.

Skill content

BASE_URL="https://www.skanetrafiken.se/gw-tps/api/v2/Journey"
PARAMS="fromPointId=${FROM_ID_ENCODED}&fromPointType=${FROM_TYPE}&toPointId=${TO_ID_ENCODED}&toPointType=${TO_TYPE}"

Recommendation

Use the skill only when comfortable sending the queried locations and travel times to Skånetrafiken; avoid exact sensitive home/work addresses if privacy is a concern.