Tabussen
PassAudited by ClawScan on May 1, 2026.
Overview
The skill appears to do what it says—query ResRobot for Västerbotten/Umeå transit planning—but users should notice that it needs curl/jq and a ResRobot API key that are not fully declared in the registry metadata.
Before installing, confirm you are comfortable using an API-based transit planner that sends your trip searches to ResRobot, set a dedicated RESROBOT_API_KEY, and ensure curl and jq are available. The reviewed artifacts do not show hidden persistence, destructive actions, or behavior outside the stated trip-planning purpose.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
You need to provide a ResRobot API key, and your stop IDs, coordinates, dates, and times may be associated with that key by the API provider.
The script requires a ResRobot/Trafiklab API key and includes it in requests to the ResRobot trip API. This is expected for the stated integration, but users should understand that their API key and trip-query parameters are sent to the provider.
API_KEY="${RESROBOT_API_KEY:-YOUR_API_KEY_HERE}" ... PARAMS="format=json&accessId=${API_KEY}&passlist=1&numF=5"Use a dedicated ResRobot API key, keep it out of shared logs or transcripts, and rotate it if it is exposed.
Installation or first use may fail unless curl, jq, and a ResRobot API key are available, and there is no linked upstream homepage to verify provenance.
The registry metadata omits provenance and declares no binaries, env vars, or credentials, while the visible SKILL.md/scripts require curl, jq, and RESROBOT_API_KEY. This is an install/disclosure gap, not evidence of hidden behavior.
Source: unknown; Homepage: none; Required binaries (all must exist): none; Required env vars: none; Primary credential: none
Review the included shell scripts before use, install curl and jq if needed, and configure RESROBOT_API_KEY explicitly.