Poll Houston TranStar incidents RSS every 10 minutes and WhatsApp me when there are changes.

This skill contains working RSS-fetching and diff logic, but it is incomplete and misconfigured for notifications. Before installing or enabling it: 1) Do not provide any WhatsApp/API credentials until you see explicit, secure code that uses them — the package currently has no delivery implementation. 2) Fix the mismatches: SKILL.md calls transtar_diff.py but the repo contains transtar.py; main.py points at scripts/your_script.py — confirm which script is the real entrypoint and update the loader. 3) Ensure the runtime has the 'requests' library or add a dependency/install step. 4) Review where state is written (~/.openclaw/skills/houston-transtar-watch/state/last_incidents.json) and decide if that location and persistence are acceptable. 5) If you want WhatsApp delivery, prefer using a well-known gateway (e.g., Twilio) and ensure credentials are provided via secure environment variables (and documented in the skill) rather than hardcoded. If the maintainer provides an updated package with clear delivery code and documented, minimal env vars, the assessment could be upgraded to benign.

Type: OpenClaw Skill Name: houston-transtar-watch Version: 1.0.0 The skill is suspicious due to a critical misconfiguration in `main.py`. It attempts to execute a non-existent script named `your_script.py` via `subprocess.run` using a relative path (`../../scripts/your_script.py`). This path resolution is unusual and could lead to arbitrary code execution if an attacker could place a malicious `your_script.py` in the resolved directory. Additionally, the `SKILL.md` instructs the agent to run `transtar_diff.py`, which also does not exist, while the actual functional code is in `transtar.py` (present twice, once in `scripts/` and once at the root). This combination of non-existent script execution and path ambiguity represents a significant vulnerability, even though the `transtar.py` script itself appears benign.