NS Trains

Check Dutch train schedules, departures, disruptions, and plan journeys using the NS API. Perfect for daily commute checks.

This skill appears to be what it says: it queries the official NS API and only needs your NS subscription key. Before installing, consider: (1) Keep NS_SUBSCRIPTION_KEY secret — inject it via your runtime secret manager rather than committing it. (2) The included ns-api.mjs enforces HTTPS and an allowlist (gateway.apiportal.ns.nl) and sets the Ocp-Apim-Subscription-Key header — you can review that file yourself (it's included) to confirm no other hosts are contacted. (3) Ensure your environment has a compatible Node version (modern Node provides global fetch). (4) Because the code runs locally, only grant the subscription key if you trust this skill source; if you obtain the key elsewhere (or rotate it), revoke it from the NS API portal if you suspect exposure. Overall the package is internally consistent and minimal for its purpose.

Type: OpenClaw Skill Name: ns-trains Version: 1.1.0 This skill is classified as benign. The code is well-structured and clearly aligned with its stated purpose of checking Dutch train schedules via the NS API. A critical security control is implemented in `scripts/ns-api.mjs`, which enforces an HTTPS-only connection and an explicit allowlist for the NS API host (`gateway.apiportal.ns.nl`), preventing arbitrary network egress. The `SKILL.md` instructions are straightforward and do not contain any prompt injection attempts. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or obfuscation. Environment variables are handled appropriately for API key management and user-defined commute stations.