Wheels Router

• Analyzed: May 12, 2026, 3:05 AM
• Findings: 1
• Version: 0.5.0
• Hash: 39dc3b20383fcf0436f0ae39514fb864c788af6c7a48e19dc9a71a944642f229
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is designed to connect to an external MCP server (`https://mcp.justusewheels.com/mcp`) for transit planning, which involves network communication and potentially executing `npx mcp-remote`. While these are high-risk capabilities, they are explicitly stated and directly aligned with the skill's core purpose. A minor prompt injection instruction in `SKILL.md` guides the agent on how to summarize output by default, which is a benign instruction for user experience and not indicative of malicious intent or data exfiltration.