tfl-cli

London transport CLI — tube status, journey planning, live arrivals, disruptions, bike docks, and agent-friendly projection via `--output <path>` for route,...

Security Scan

The skill is internally consistent with its stated purpose: it wraps an npm-distributed CLI called 'tfl', does not request unrelated credentials, and its instructions only describe running that CLI.

Purpose & Capability

The name/description (London transport CLI) match the declared binary requirement ('tfl') and the install spec (npm package @shan8851/tfl-cli that creates the 'tfl' binary). There are no unrelated environment variables, credentials, or config paths required.

Instruction Scope

SKILL.md only describes how to use the tfl CLI (status, route, arrivals, bikes, search, output projection). It does not instruct the agent to read unrelated files, system config, or to transmit data to arbitrary endpoints. It does mention an optional TFL_APP_KEY environment variable for higher rate limits, which is expected for a TfL client.

Install Mechanism

Installation is via an npm package (@shan8851/tfl-cli) that provides the 'tfl' binary — this is a typical and expected mechanism. npm packages can contain arbitrary code, so installing from the public registry carries the usual moderate risk compared with instruction-only skills; however, no suspicious download URLs or archive extraction from unknown hosts are present.

Credentials

The skill declares no required env vars (none listed), which fits basic usage. SKILL.md mentions an optional TFL_APP_KEY for higher rate limits; that optional variable is reasonable but is not listed in the metadata as an optional env var—minor documentation mismatch. The skill does not request unrelated secrets or multiple credentials.

Persistence & Privilege

Defaults are used (always: false, user-invocable true). The skill does not request persistent presence or modify other skills or system-wide settings. Autonomous invocation is allowed (platform default) but is not combined with other red flags.

Assessment

This skill appears to be a straightforward wrapper around an npm-distributed TfL CLI and is coherent with its description. Before installing: (1) verify the npm package and author (npmjs.com/package/@shan8851/tfl-cli and the package's repository/homepage) so you trust the maintainers; (2) prefer installing in a sandbox/container or review the package contents if you require higher assurance (npm packages can execute arbitrary code during postinstall); (3) be aware the SKILL.md mentions an optional TFL_APP_KEY—only set that env var if you trust the package and the key itself; (4) because this is instruction-only, the static scanner had no package code to analyze—inspect the published npm package or its repo if you need stronger guarantees.

Use tfl for London transport: tube status, journey planning, disruptions, live arrivals, bike availability, and stop search.

Setup

• npm install -g @shan8851/tfl-cli
• Optional: set TFL_APP_KEY for higher rate limits (basic usage works without any key)

Status

• All lines: tfl status
• Specific line: tfl status jubilee
• Filter by mode: tfl status --mode tube,dlr

Disruptions

• Current disruptions: tfl disruptions
• Specific line: tfl disruptions piccadilly

Journey Planning

• Station to station: tfl route "waterloo" "kings cross"
• Postcode to postcode: tfl route "SE1 9SG" "EC2R 8AH"
• Arrive by time: tfl route "waterloo" "bank" --arrive-by --time 09:00
• With preferences: tfl route "waterloo" "paddington" --preference least-interchange
• Via a waypoint: tfl route "waterloo" "paddington" --via "bank"
• Project one route field: tfl route "SE1 9SG" "EC2R 8AH" --output journeys.0.durationMinutes
• Project route legs: tfl route "waterloo" "canary wharf" --output journeys.0.legs

Arrivals

• Next arrivals: tfl arrivals "waterloo"
• Specific line: tfl arrivals "king's cross" --line northern --limit 5
• Filter direction: tfl arrivals "waterloo" --direction inbound
• Project one value: tfl arrivals "waterloo" --output arrivals.0.timeToStationSeconds
• Project in JSON: tfl arrivals "waterloo" --json --output arrivals.0.lineName

Bikes

• Near postcode: tfl bikes "SE1 9SG"
• Custom radius: tfl bikes "waterloo" --radius 750 --limit 5
• Project one value: tfl bikes "SE1 9SG" --output bikePoints.0.bikes
• Project one subtree: tfl bikes "SE1 9SG" --output bikePoints.0

Search

• Find stops/stations: tfl search stops "paddington"
• Limit results: tfl search stops "paddington" --limit 10

Output

• All commands default to text in TTY and JSON when piped
• Force JSON: tfl status --json
• Force text: tfl status --text
• Disable colour: tfl --no-color status
• Success envelope: { ok, schemaVersion, command, requestedAt, data }
• Error envelope: { ok, schemaVersion, command, requestedAt, error }

Agent Notes

• --output <path> is available on route, arrivals, and bikes
• Paths use dot notation with zero-based array indexes, for example journeys.0.durationMinutes or arrivals.0.lineName
• In text mode, scalar projections print just the value
• In text mode, object or array projections print plain pretty JSON
• Projection errors are structured: malformed paths return INVALID_INPUT, missing paths return NOT_FOUND

Notes

• No API key required for basic usage
• Accepts station names, postcodes (SE1 9SG), coordinates (51.50,-0.12), and TfL stop IDs
• Status and disruptions cover tube, overground, DLR, and Elizabeth line
• Exit codes: 0 success, 2 bad input or ambiguity, 3 upstream failure, 4 internal error
• When a station name is ambiguous, the error includes candidate suggestions