joeholdcroft/rail-commute-watch
Calendar-gated UK rail monitoring before departure and during the journey, with configurable hours, useful alternatives and meaningful arrival-change alerts.
91%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
Low
Low-risk findings worth noting
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
The workflow fetches live rail data and disruption notices from web sources such as National Rail, Thameslink, Trainline, and Traksy, which ingest outsider-authored train status and incident texts.
Where we found it
nationalrail.co.uk
domain · 3 sites
The plugin instructs fetching live departure/arrival boards and Darwin feed data from National Rail's public website and developer APIs at runtime.
references/sources.md
5
https://www.nationalrail.co.uk/live-trains/
references/sources.md
8
https://www.nationalrail.co.uk/developers/darwin-data-feeds/
references/sources.md
10
https://www.nationalrail.co.[REDACTED]/
thameslinkrailway.com
domain · 2 sites
The plugin instructs fetching live departures/arrivals and service updates from Thameslink's website at runtime.
references/sources.md
6
https://www.thameslinkrailway.[REDACTED]
references/sources.md
7
https://www.thameslinkrailway.com/service-updates/service-updates
thetrainline.com
domain · 1 site
The plugin instructs fetching live boards from Trainline's website at runtime as supplementary evidence.
references/sources.md
16
https://www.thetrainline.com/live/
traksy.uk
domain · 1 site
The plugin instructs fetching service movements and timetable detail from Traksy's website at runtime.
references/sources.md
24
https://traksy.uk/
realtime.nationalrail.co.uk
domain · 1 site
The plugin references the National Rail Live Departure Board API (LDBWS) hosted at realtime.nationalrail.co.uk as an authorized data source.
references/sources.md
8
https://realtime.nationalrail.co.uk/LDBWS/docs/documentation.html
- Audited
- Security analysis