ClawHub

MBTA Transit

v1.0.1

Provides real-time MBTA transit info including next departures, service alerts, live vehicle locations, stop searches, and route listings for Boston-area tra...

⭐ 0· 87·0 current·0 all-time
byDavid Larrabee@squidpunch
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
medium confidence
✓
Purpose & Capability
Name/description (real-time MBTA data) aligns with the included code and README: the script calls https://api-v3.mbta.com endpoints to list stops, departures, alerts, vehicles, and routes. No unrelated services, binaries, or credentials are requested.
ℹ
Instruction Scope
SKILL.md instructs the agent to run the included Python CLI and to optionally use MBTA_API_KEY for higher rate limits. The instructions do not ask the agent to read arbitrary files or send data to third-party endpoints. Minor inconsistency: SKILL.md claims the MBTA API "doesn't support filter[name]" and the script fetches parent stations and filters client-side, while references/API.md lists filter[name] as an endpoint parameter — this is a documentation mismatch but not a security issue.
✓
Install Mechanism
No install spec; it's an instruction-only skill with a bundled Python script. Nothing is downloaded from arbitrary URLs and no archives are extracted. The script uses only standard Python libraries (urllib, json, datetime).
✓
Credentials
Only an optional MBTA_API_KEY is referenced (for higher rate limits). No other secrets, tokens, or config paths are requested. The script reads only that env var and nothing else.
✓
Persistence & Privilege
Skill does not request permanent presence (always:false). It does not modify other skills or system configs. Autonomous invocation is allowed by default (not flagged by itself), which is reasonable for an informational CLI skill.
Assessment
This skill appears to be what it says: a simple MBTA API client. Before installing, confirm the skill package is complete (the provided script was truncated in the review copy — verify the full script shipped with the skill), and inspect the end of the Python file for any unexpected network calls or writes. If you use an MBTA_API_KEY, store it securely (as an environment variable) and be aware of rate limits. The only minor issue is a documentation mismatch about filter[name]; functionally the CLI queries the official MBTA API and does not request unrelated credentials or external endpoints.

Like a lobster shell, security has layers — review code before you run it.

bostonvk972q9rqv3ze96mmcpzc5ham8d83aztelatestvk975ef2df2bzzdwaj0dtqnszys83bzkjmbtavk972q9rqv3ze96mmcpzc5ham8d83aztetransitvk972q9rqv3ze96mmcpzc5ham8d83aztetransportationvk972q9rqv3ze96mmcpzc5ham8d83azte

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments