Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Hong Kong transit routing tool that uses Google Maps and public ETA services, with no evidence of hidden or malicious behavior.
Install only if you are comfortable sending origin and destination information to Google Maps and public Hong Kong transit data services. Use a Google Maps API key restricted to the needed Directions API with quotas, and be aware that the skill keeps a local public ETA database cache under ~/.cache/hk-route.
Referenced artifact was not completely inspected
The bundled `scripts/hk-route.cjs` is built from readable TypeScript source at [github.com/7ito/hkroute](https://github.com/7ito/hkroute). Build command: `esbui
Referenced artifact was not completely inspected
The bundled `scripts/hk-route.cjs` is built from readable TypeScript source at [github.com/7ito/hkroute](https://github.com/7ito/hkroute). Build command: `esbui
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
if (!(key in state.jobs)) {
return;
}
delete state.jobs[key];
if (error) {
abort(state);
} else {
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
],
scripts: {
build: "tsc",
docs: "rm -rf docs/ && typedoc src/index.ts",
prepack: "npm run build",
pretest: "npm run build",
test: "jest --runInBand --collectCoverage ./src/* && npm run test:loading",
The skill declares executable and privileged capabilities in metadata and behavior (environment variable access, network requests, and shell/Node execution) but does not explicitly constrain them with a tool-scope or permissions declaration. This creates a trust and governance gap: a host agent may permit broader execution than intended, making review, policy enforcement, and least-privilege controls harder.
The implicit activation rules are broad enough to trigger on ordinary travel-related conversation, causing the skill to run without an explicit user request for this specific integration. In context, that can lead to unanticipated external API calls, use of the Google Maps API key, and transmission of user-provided location data to third parties when the user may have only been asking a general question.
The skill creates a persistent cache file under the user's home directory (~/.cache/hk-route/etaDb.json) and writes downloaded route data to disk. This is not remote code execution or direct data exfiltration, but it is a real security/privacy concern because it persists data outside the explicitly described routing action and does so without user awareness or opt-in.
The script silently writes a persistent cache file into the user's home directory. Even though the cached data appears to be transit metadata rather than user secrets, undisclosed persistent storage can violate least surprise, create privacy/compliance issues, and leave stale data on shared systems.
The script reads GOOGLE_MAPS_API_KEY and sends it in outbound requests to Google Maps. Using an API key for its intended provider is normal, but from a security/privacy standpoint this is still sensitive outbound secret use and the file provides no disclosure, scoping, or guardrails around where the secret is sent.
The Google Maps directions request forces region: "hk", which imposes a specific locale/region behavior in the skill without any visible user opt-in or explanation in this file. The policy allows locale constraints only when the user is given a choice or the constraint is clearly documented and justified.
The code hard-codes language: "en" for ETA retrieval, which imposes a specific language on all users. This is a natural-language policy concern because the file provides no user opt-in, fallback, or documented reason for restricting output to English.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
...routeEntry,
seq: stopIdx,
language: "en",
stopList: etaDb.stopList,
holidays: etaDb.holidays,
serviceDayMap: etaDb.serviceDayMap,
});
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
...routeEntry,
seq: stopIdx,
language: "en",
stopList: etaDb.stopList,
holidays: etaDb.holidays,
serviceDayMap: etaDb.serviceDayMap,
});
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
...routeEntry,
seq: stopIdx,
language: "en",
stopList: etaDb.stopList,
holidays: etaDb.holidays,
serviceDayMap: etaDb.serviceDayMap,
});
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
...routeEntry,
seq: stopIdx,
language: "en",
stopList: etaDb.stopList,
holidays: etaDb.holidays,
serviceDayMap: etaDb.serviceDayMap,
});
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
...routeEntry,
seq: stopIdx,
language: "en",
stopList: etaDb.stopList,
holidays: etaDb.holidays,
serviceDayMap: etaDb.serviceDayMap,
});
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
...routeEntry,
seq: stopIdx,
language: "en",
stopList: etaDb.stopList,
holidays: etaDb.holidays,
serviceDayMap: etaDb.serviceDayMap,
});
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
...routeEntry,
seq: stopIdx,
language: "en",
stopList: etaDb.stopList,
holidays: etaDb.holidays,
serviceDayMap: etaDb.serviceDayMap,
});
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
...routeEntry,
seq: stopIdx,
language: "en",
stopList: etaDb.stopList,
holidays: etaDb.holidays,
serviceDayMap: etaDb.serviceDayMap,
});
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
...routeEntry,
seq: stopIdx,
language: "en",
stopList: etaDb.stopList,
holidays: etaDb.holidays,
serviceDayMap: etaDb.serviceDayMap,
});
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
...routeEntry,
seq: stopIdx,
language: "en",
stopList: etaDb.stopList,
holidays: etaDb.holidays,
serviceDayMap: etaDb.serviceDayMap,
});
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
...routeEntry,
seq: stopIdx,
language: "en",
stopList: etaDb.stopList,
holidays: etaDb.holidays,
serviceDayMap: etaDb.serviceDayMap,
});
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
...routeEntry,
seq: stopIdx,
language: "en",
stopList: etaDb.stopList,
holidays: etaDb.holidays,
serviceDayMap: etaDb.serviceDayMap,
});
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
...routeEntry,
seq: stopIdx,
language: "en",
stopList: etaDb.stopList,
holidays: etaDb.holidays,
serviceDayMap: etaDb.serviceDayMap,
});
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
...routeEntry,
seq: stopIdx,
language: "en",
stopList: etaDb.stopList,
holidays: etaDb.holidays,
serviceDayMap: etaDb.serviceDayMap,
});
Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal