Habilidades youbike-realtime

📦

youbike-realtime

Name: youbike-realtime
Author: tahodev

Revisión del contenido r1 Seguro ⚙️ Comandos externos🌐 Acceso a red📁 Acceso al sistema de archivos

Find Available YouBike Bicycles and Return Spaces

Finding a bicycle or an empty return space requires current station information. This skill guides public-feed queries for YouBike availability across Taiwan.

Compatible con: Claude Codex Code(CC)

🥉 77 Bronce

Maintain this Skill? Claim it 🥉 77 Bronce

Instalar con mi Agente

Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.

Solicitud de agente

Review the Skillstore skill "youbike-realtime" from https://skillstore.io/skills/tahodev-youbike-realtime.md and its manifest at https://skillstore.io/api/skills/tahodev-youbike-realtime/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.

Recursos legibles por agentes

Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.

Detalle Markdown GET /skills/tahodev-youbike-realtime.md Manifest firmado GET /api/skills/tahodev-youbike-realtime/manifest Lockfile firmado GET /api/skills/tahodev-youbike-realtime/lockfile

Pruébalo

Usando "youbike-realtime". Show an example station availability response.

Resultado esperado:

Illustrative response only, not live station data.
Example Station A: 8 bicycles available, including 2 electric bicycles; 12 return spaces.
Status: operating. Source: unified YouBike feed.
Data updated: 2026-09-26 09:30:00 Taiwan time, UTC+8.

Usando "youbike-realtime". What would you report if both Taipei data sources failed?

Resultado esperado:

Illustrative failure response: current Taipei station availability could not be confirmed.
The unified and municipal feeds did not provide usable data.
Check the official YouBike app or website before departure. Older data is not being presented as live.

Auditoría de seguridad

Seguro

v1 • 13/10/2026 Abrir el informe versionado

Reviewed all 114 static findings: 109 are false positives from Markdown formatting, public-data URLs, read-only queries, and readable multilingual text. Five downloads use predictable shared temporary paths, allowing local symlink overwrite or cache tampering when another user controls those paths. No evidence found of prompt injection, credential access, or data exfiltration.

Archivos escaneados

239

Líneas analizadas

Elementos de revisión

Falsos positivos ignorados

Elementos de revisión de capacidades (5)

Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.

Medio

SKILL.md:26

Temp directory access

curl -sm 60 https://apis.youbike.com.tw/json/station-yb2.json -o /tmp/youbike_all.json

Curl writes to predictable /tmp/youbike_all.json without creating a private directory. A local attacker can precreate a writable symlink target or tamper with shared cache data.

Medio

SKILL.md:105

Temp directory access

curl -sm 30 https://tcgbusfs.blob.core.windows.net/dotapp/youbike/v2/youbike_immediate.json -o /tmp/

Curl writes to predictable /tmp/youbike.json without establishing private ownership. A local attacker can redirect a writable download through a symlink or alter shared cache contents.

Medio

SKILL.md:132

Temp directory access

curl -sm 30 'https://data.ntpc.gov.tw/api/datasets/010E5B15-3823-4B20-B401-B1CF000550C5/json?page=0&

Curl downloads into predictable /tmp/youbike_ntpc.json without a private directory. Preexisting attacker-controlled symlinks can redirect writable output, and shared files permit cache tampering.

Medio

SKILL.md:160

Temp directory access

curl -sm 30 'https://newdatacenter.taichung.gov.tw/api/v1/no-auth/resource.download?rid=9468c0d0-e1e

Curl writes directly to predictable /tmp/youbike_tc.json. Without private ownership, another local user can precreate a writable symlink target or supply tampered cache data.

Medio

SKILL.md:168

Temp directory access

curl -sm 30 'https://opendata.tycg.gov.tw/api/v1/dataset.api_access?rid=08274d61-edbe-419d-8fcc-7a64

Curl writes directly to predictable /tmp/youbike_ty.json without isolating the cache. Local attackers can exploit preexisting writable symlinks or alter shared station data.

Factores de riesgo

⚙️ Comandos externos (50)

🌐 Acceso a red (6)

SKILL.md:26 SKILL.md:105 SKILL.md:132 SKILL.md:160 SKILL.md:168 SKILL.md:225

📁 Acceso al sistema de archivos (15)

SKILL.md:26 SKILL.md:67 SKILL.md:71 SKILL.md:76 SKILL.md:83 SKILL.md:92 SKILL.md:105 SKILL.md:126 SKILL.md:132 SKILL.md:152 SKILL.md:160 SKILL.md:168 SKILL.md:195 SKILL.md:199 SKILL.md:210

Auditado por: codex

Compartir y citar este informe

Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.

Abrir el informe versionado

Copiar enlace del informe

https://skillstore.io/skills/tahodev-youbike-realtime/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Insignia Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/tahodev-youbike-realtime/security.svg)](https://skillstore.io/skills/tahodev-youbike-realtime?utm_source=security_passport_badge)

Insignia HTML

<a href="https://skillstore.io/skills/tahodev-youbike-realtime?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/tahodev-youbike-realtime/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Tarjeta para insertar

<iframe src="https://skillstore.io/embed/skills/tahodev-youbike-realtime.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citas académicas (APA · BibTeX · CFF)

Cita APA

tahodev. (2026). youbike-realtime security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/tahodev-youbike-realtime/audits/1

Cita BibTeX

@techreport{tahodev-tahodev-youbike-realtime-2026,
  author = {tahodev},
  title = {youbike-realtime security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/tahodev-youbike-realtime/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "youbike-realtime security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "tahodev"
date-released: "2026-10-13"
url: "https://skillstore.io/skills/tahodev-youbike-realtime/audits/1"
identifiers:
  - type: other
    value: "skillstore:tahodev-youbike-realtime:audit:1"
    description: "Skillstore immutable audit report identifier"

Puntuación de Skillstore

Por qué esta puntuación Confianza de la evidencia: Medio

Arquitectura

Mantenibilidad

Contenido

Comunidad

Cumplimiento de la especificación

Lo que puedes crear

Check Bicycles Before Commuting

Find operating stations near a district or landmark, compare bicycle counts, and confirm the data update time.

Locate Electric Bicycles While Traveling

Find stations with electric bicycles in a supported service area and review available return spaces.

Compare Cross-City Station Availability

Normalize Taipei and New Taipei feeds, compare station availability, and identify source failures or incomplete responses.

Prueba estos prompts

Check a District

Find operating YouBike stations in Taipei Daan District with bicycles available. Include return spaces and each source update time.

Find Electric Bicycles

Find operating stations with electric bicycles in New Taipei Banqiao District. Show electric counts, return spaces, source, and update time.

Rank Nearby Stations

Find five operating stations with bicycles nearest to latitude 25.033 and longitude 121.565. Include addresses and timestamps; label proximity ranking as approximate.

Compare Fallback Feeds

Compare Taipei and New Taipei stations using municipal fallback feeds. Normalize fields, check pagination and freshness, and report failures without presenting stale data as live.

Mejores prácticas

Include the source update time in Taiwan local time and recheck availability before departure.
Reuse a fresh response for one or two minutes and use private temporary storage for downloads.
Validate response format, source-specific fields, operating status, and pagination before reporting availability.

Evitar

Presenting stale, empty, or invalid feed responses as current station availability.
Applying one city's field names or electric-bicycle parsing rules to every source.
Polling continuously or treating approximate coordinate ranking as a walking route.

Preguntas frecuentes

Do I need an API key or account?

The documented queries use public feeds without API keys or login. Your environment needs network access, curl, and jq.

Which areas are covered?

The unified feed covers 14 documented service areas, including Taipei, New Taipei, Taoyuan, Taichung, Tainan, and Kaohsiung. Coverage can change.

Can I find electric bicycles?

Yes, the unified feed includes electric-bicycle counts. Municipal formats differ, and the Taipei municipal feed does not provide those counts.

Can it reserve a bicycle or calculate fees?

No. The skill supports station availability lookups, not reservations, rentals, payments, or fee calculations.

What happens when the unified feed is unavailable?

Use municipal feeds for Taipei, New Taipei, Taichung, or Taoyuan. For other areas, report the failure and recommend official confirmation.

Are nearby stations ranked by walking distance?

No. The example uses squared coordinate differences for approximate proximity. It does not calculate walking routes or travel times.

Detalles del desarrollador

Autor

tahodev

Licencia

MIT

Revisión de Skillstore

Aviso de versión

El autor no declaró una versión.

Repositorio

https://github.com/tahodev/baodao-skill/tree/3ce4b58e4525f5a66390e1236b6d38702790225a/youbike-realtime

Ref.

2aab20a3878daa05021884e089a7dd7739e08581

Actualidad del mantenimiento

13/10/2026

Uso

0 descargas · 0 vistas

Estructura de archivos

📄 SKILL.md