Mvg

Munich public transport (MVG) CLI and S-Bahn live tracking. Use for departure times, route planning, nearby stations, service alerts, and real-time S-Bahn po...

This skill appears to implement the MVG CLI functions it advertises, but there are several things to check before installing or running it: 1) The code contains an embedded GEOPS_API_KEY and GEOPS_ORIGIN — ask the author why a key is hardcoded, whether it is a public demo key, and what permissions that key has; treat embedded keys as sensitive. 2) The SKILL.md/README disagree about dependencies and the live-tracking implementation (Node+ws vs. Python/geOps). Ask the author to clarify required runtime components and to document any keys or persistent storage. 3) The CLI writes a session file to ~/.mvg_session.json — review the file contents after first run to ensure it does not store sensitive data. 4) If you cannot verify the geOps key or the maintainer, prefer running the CLI in a sandboxed environment or inspect the full source locally before use. If the key is intended to be private, do not use the skill until the key is removed or replaced with documentation instructing users to supply their own API key via environment variable.

Type: OpenClaw Skill Name: mvg-cli Version: 0.1.0 The skill is classified as suspicious due to the use of `subprocess.run` in `mvg_cli.py` to execute a dynamically generated JavaScript file via `node`. While the JavaScript code and its arguments are currently hardcoded and serve a legitimate purpose (fetching S-Bahn live data from `api.geops.io`), this pattern introduces a significant Remote Code Execution (RCE) risk. If an attacker could modify the hardcoded JavaScript or its execution parameters (e.g., via a supply chain attack on the skill bundle), it would lead to arbitrary code execution. This is a powerful and risky capability, even if not explicitly malicious in its current, hardcoded form. Additionally, the `README.md` and `mvg_cli.py` have inconsistent dependency information regarding the `requests` library and `node`/`ws` module, though this is a minor issue.