Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

12306 Backup

v1.0.0

Query China Railway 12306 for train schedules, remaining tickets, and station info. Use when user asks about train/高铁/火车 tickets, schedules, or availability...

0· 71·0 current·0 all-time
bysteve xia@danihe001·fork of @kirorab/12306 (1.0.2)
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description, SKILL.md, and the two JS scripts all focus on querying 12306, parsing results, and producing HTML/MD/JSON output. The only required binary is node, which is appropriate for the provided Node.js scripts.
Instruction Scope
Runtime instructions only run the included scripts. The scripts fetch data from 12306 domains, parse and filter results, and write cache/output files under the skill's data path — all within the described scope. No unrelated files, system credentials, or external endpoints are accessed.
Install Mechanism
This is an instruction-only skill with included scripts and no install spec. No downloads from third-party URLs or archive extraction are performed by the skill itself.
Credentials
The skill requires no environment variables or credentials. It only needs Node.js runtime; no unexpected secret access is requested.
Persistence & Privilege
always is false and the skill does not request permanent platform privileges. It caches station data and writes output files under its own data path only, which is expected behavior.
Assessment
Functionally and security-wise the skill is coherent with its purpose: it fetches data from official 12306 endpoints and caches station data locally, and it does not request secrets. Before installing, however, verify the skill's provenance (source/homepage is unknown here) and run it in a trusted/isolated environment if you don't trust the author. Also ensure you have Node.js >=18 (the code uses global fetch) and be aware the scripts will create/overwrite files under the skill's data directory and any output paths you provide. If you need higher assurance, review the included scripts locally (they are short and readable) or run them with network monitoring to confirm they only contact 12306 domains.
!
scripts/stations.mjs:3
File read combined with network send (possible exfiltration).
About static analysis
These patterns were detected by automated regex scanning. They may be normal for skills that integrate with external APIs. Check the VirusTotal and OpenClaw results above for context-aware analysis.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🚄 Clawdis
Binsnode
latestvk9749vxkz2abq0bp8cps66rzvs849erm
71downloads
0stars
1versions
Updated 2w ago
v1.0.0
MIT-0

12306 Train Query

Query train schedules and remaining tickets from China Railway 12306.

Query Tickets

node {baseDir}/scripts/query.mjs <from> <to> [options]
  • HTML mode (default): writes file, prints path to stdout
  • Markdown mode (-f md): prints table to stdout

Examples

# All trains from Beijing to Shanghai (defaults to today)
node {baseDir}/scripts/query.mjs 北京 上海

# Markdown table output (to stdout, good for chat)
node {baseDir}/scripts/query.mjs 北京 上海 -t G -f md

# Morning departures, 2h max, with second class available
node {baseDir}/scripts/query.mjs 上海 杭州 -t G --depart 06:00-12:00 --max-duration 1h --seat ze

# Only bookable trains arriving before 6pm
node {baseDir}/scripts/query.mjs 深圳 长沙 --available --arrive -18:00

# Custom output path
node {baseDir}/scripts/query.mjs 广州 武汉 -o /tmp/tickets.html

# JSON output (to stdout)
node {baseDir}/scripts/query.mjs 广州 武汉 --json

Options

  • -d, --date <YYYY-MM-DD>: Travel date (default: today)
  • -t, --type <G|D|Z|T|K>: Filter train types (combinable, e.g. GD)
  • --depart <HH:MM-HH:MM>: Depart time range (e.g. 08:00-12:00, 18:00-)
  • --arrive <HH:MM-HH:MM>: Arrive time range (e.g. -18:00, 14:00-20:00)
  • --max-duration <duration>: Max travel time (e.g. 2h, 90m, 1h30m)
  • --available: Only show bookable trains
  • --seat <types>: Only show trains with tickets for given seat types (comma-separated: swz,zy,ze,rw,dw,yw,yz,wz)
  • -f, --format <html|md>: Output format — html (default, saves file) or md (markdown table to stdout)
  • -o, --output <path>: Output file path, html mode only (default: {baseDir}/data/<from>-<to>-<date>.html)
  • --json: Output raw JSON to stdout

Output Columns

ColumnMeaning
商务/特等Business class / Premium (swz)
一等座First class (zy)
二等座Second class (ze)
软卧/动卧Soft sleeper / Bullet sleeper (rw/dw)
硬卧Hard sleeper (yw)
硬座Hard seat (yz)
无座Standing (wz)

Values: number = remaining seats, = available (qty unknown), = not applicable

Station Lookup

node {baseDir}/scripts/stations.mjs 杭州
node {baseDir}/scripts/stations.mjs 香港西九龙

Notes

  • Data comes directly from 12306 official API (no key needed)
  • Station data is cached for 7 days in {baseDir}/data/stations.json
  • Supports city names (resolves to main station) or exact station names
  • Works for all train types: G (高铁), D (动车), Z (直达), T (特快), K (快速)

Comments

Loading comments...