Tabussen

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

You need to provide a ResRobot API key, and your stop IDs, coordinates, dates, and times may be associated with that key by the API provider.

Why it was flagged

The script requires a ResRobot/Trafiklab API key and includes it in requests to the ResRobot trip API. This is expected for the stated integration, but users should understand that their API key and trip-query parameters are sent to the provider.

Skill content

API_KEY="${RESROBOT_API_KEY:-YOUR_API_KEY_HERE}" ... PARAMS="format=json&accessId=${API_KEY}&passlist=1&numF=5"

Recommendation

Use a dedicated ResRobot API key, keep it out of shared logs or transcripts, and rotate it if it is exposed.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installation or first use may fail unless curl, jq, and a ResRobot API key are available, and there is no linked upstream homepage to verify provenance.

Why it was flagged

The registry metadata omits provenance and declares no binaries, env vars, or credentials, while the visible SKILL.md/scripts require curl, jq, and RESROBOT_API_KEY. This is an install/disclosure gap, not evidence of hidden behavior.

Skill content

Source: unknown; Homepage: none; Required binaries (all must exist): none; Required env vars: none; Primary credential: none

Recommendation

Review the included shell scripts before use, install curl and jq if needed, and configure RESROBOT_API_KEY explicitly.