Metra Skill

Chicago Metra commuter rail — real-time train arrivals, vehicle tracking, service alerts, and schedule info for all 11 Metra lines serving the Chicago metrop...

What to check before installing: - Confirm the METRA_API_KEY requirement: SKILL.md and the code require METRA_API_KEY, but the registry metadata omitted it. Don't install if the platform would grant broader secrets than this. - Verify the external endpoints: the script uses gtfspublic.metrarr.com (GTFS-RT) and schedules.metrarail.com (static). Confirm those hosts are legitimate (they look related to Metra but double-check the GTFS-RT hostname). If unsure, open the repository link and inspect the endpoints yourself. - Expect to run `npm install` in the skill folder (installs protobufjs from npm). Run this in a controlled environment if you audit dependencies first. - The skill will create ~/.metra/gtfs/ and read GTFS CSV files; if you prefer no persistent files, don't install or run refresh-gtfs. - The script reads a local .env file in the skill directory — avoid storing long-lived credentials in places you don't control, or use an agent-managed secret store instead. - If you want higher assurance, review the full scripts/metra.mjs contents (it uses child_process.execFileSync for local unzip operations) and test the skill in a sandboxed environment first. If you want, I can point out exact lines in scripts/metra.mjs that reference the endpoints, .env loading, unzip/exec usage, and the GTFS cache location.

Type: OpenClaw Skill Name: metra Version: 1.0.0 The OpenClaw Metra skill is designed to provide real-time Metra transit information. It uses standard Node.js practices, fetches data from official Metra API endpoints over HTTPS, and stores static GTFS data locally in the user's home directory. The `SKILL.md` and `README.md` provide clear, benign instructions for the AI agent and users. The `scripts/metra.mjs` code uses `node:util.parseArgs` for robust command-line argument parsing and `execFileSync` with fixed arguments for `unzip`, mitigating shell injection risks from user input. No evidence of intentional harmful behavior, data exfiltration, persistence, or malicious prompt injection was found.