← Back to Skills Marketplace
1995
Downloads
2
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install uk-trains
Description
Query UK National Rail live departure boards, arrivals, delays, and train services. Use when asked about train times, departures, arrivals, delays, platforms, or "when is the next train" for UK railways. Supports all GB stations via Darwin/Huxley2 API.
Usage Guidance
This skill appears to implement what it says (query UK train boards) but there are a few things to check before installing or enabling it:
- Expect to provide a NATIONAL_RAIL_TOKEN (Darwin API token). The registry metadata currently omits this — verify the skill will not be run without your consent. Store the token in a scoped place (skill config) rather than a broadly-shared environment variable when possible.
- The bash CLI relies on curl and jq; ensure those are available and trustworthy on the host.
- The bash script allows overriding HUXLEY_URL via the HUXLEY_URL environment variable. Do not set HUXLEY_URL to an untrusted endpoint — an attacker-controlled endpoint could receive your token and data. Prefer the default Huxley/Darwin endpoints or the Python SOAP client which calls realtime.nationalrail.co.uk directly.
- Review the scripts locally (they are provided) and test with a throwaway token first. If you need higher assurance, ask the publisher to update the registry metadata to declare required env vars (NATIONAL_RAIL_TOKEN) and required binaries (curl, jq) so the platform can surface them to users.
Because of the mismatched metadata and the endpoint-override option, treat this as suspicious until those issues are clarified.
Capability Analysis
Type: OpenClaw Skill
Name: uk-trains
Version: 1.0.0
The skill bundle is benign. Both `scripts/trains.sh` and `scripts/trains.py` interact with legitimate National Rail API endpoints (`huxley2.azurewebsites.net` and `lite.realtime.nationalrail.co.uk`) to query train information, as stated in `SKILL.md`. The `NATIONAL_RAIL_TOKEN` is read from the environment and sent to these APIs, which is an expected and documented behavior for the skill's functionality. There is no evidence of data exfiltration to unauthorized endpoints, malicious execution, persistence mechanisms, or prompt injection attempts against the agent in `SKILL.md`.
Capability Assessment
Purpose & Capability
The name/description (UK live departures/arrivals via Darwin/Huxley) matches the included Python and Bash CLIs that call National Rail/Huxley endpoints. However the registry metadata claims no required env vars or binaries while the SKILL.md and scripts require NATIONAL_RAIL_TOKEN and rely on curl/jq; this mismatch is unexpected and should be corrected.
Instruction Scope
SKILL.md and the scripts instruct the agent to call the National Rail Darwin SOAP endpoint (python) or Huxley2 REST endpoint (bash) using an API token. The instructions access the environment variable NATIONAL_RAIL_TOKEN even though the registry metadata doesn't declare it. The bash script also permits overriding HUXLEY_URL via environment, which could cause network traffic (including the token) to be sent to an arbitrary endpoint if misconfigured.
Install Mechanism
There is no install spec (instruction-only), which minimizes install-time risk. The package does include executable scripts on disk; the bash script assumes presence of curl and jq but the registry did not declare these required binaries—this is a gap in declarations rather than direct malicious behavior.
Credentials
The only runtime secret required by the code is NATIONAL_RAIL_TOKEN (appropriate for calling Darwin/Huxley APIs). That is proportionate to purpose, but the skill metadata failing to declare it is a red flag. Additionally, HUXLEY_URL can be set externally; if set to an attacker-controlled URL it could receive the token and responses. No other unrelated credentials are requested.
Persistence & Privilege
The skill does not request always:true, does not modify other skills, and does not persist new credentials or write to global configuration. It runs as a CLI and makes outbound HTTP(S) calls only when invoked.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install uk-trains - After installation, invoke the skill by name or use
/uk-trains - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release: UK National Rail departures/arrivals via Darwin API
Metadata
Frequently Asked Questions
What is UK Trains?
Query UK National Rail live departure boards, arrivals, delays, and train services. Use when asked about train times, departures, arrivals, delays, platforms, or "when is the next train" for UK railways. Supports all GB stations via Darwin/Huxley2 API. It is an AI Agent Skill for Claude Code / OpenClaw, with 1995 downloads so far.
How do I install UK Trains?
Run "/install uk-trains" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is UK Trains free?
Yes, UK Trains is completely free (open-source). You can download, install and use it at no cost.
Which platforms does UK Trains support?
UK Trains is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created UK Trains?
It is built and maintained by Jabbslad (@jabbslad); the current version is v1.0.0.
More Skills