TfL London Transit

London TfL transit — real-time Tube arrivals, bus predictions, line status, service disruptions, journey planning, and route info for the London Underground,...

This skill appears coherent and read-only: it only needs Node (18+) and optionally a TfL API key. Before installing, verify you are comfortable granting the skill network access to api.tfl.gov.uk and avoid placing any unrelated secrets in the skill's .env file (the script will read a local .env if present). Review the script if you want to confirm there are no other external endpoints or behaviors; there are no child_process calls, no eval, and no file writes. Also note some embedded station/line names look non-standard (likely harmless but may affect accuracy). If you don't want the skill to access an API key, you can run it without TFL_API_KEY (the author documents that basic usage works but is rate-limited).

Type: OpenClaw Skill Name: tfl Version: 1.0.0 The OpenClaw skill is designed to provide real-time London TfL transit data. The `scripts/tfl.mjs` file, which contains all the logic, uses native Node.js modules and `fetch` without any external dependencies, minimizing supply chain risks. User inputs are consistently sanitized using `encodeURIComponent()` before being included in API URLs, preventing injection vulnerabilities. The skill only communicates with the official `api.tfl.gov.uk` endpoint, and the optional `TFL_API_KEY` is handled securely as a query parameter. There is no evidence of data exfiltration, malicious execution (e.g., `eval`, `child_process`), persistence mechanisms, or obfuscation. The `SKILL.md` and `README.md` files contain clear, benign instructions for the AI agent, focusing solely on the skill's intended purpose without any prompt injection attempts to subvert the agent's behavior.