Capmetro Skill

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:59 PM UTC
• Version: 1.0.3

Overview

The skill appears to provide Austin transit lookups as described, but it needs review because it includes a vulnerable protobuf parser and extracts downloaded ZIP data into a local cache.

Install only if you are comfortable with a transit helper that makes public GET requests and writes a local GTFS cache. Before normal use, update protobufjs to a patched current 8.x release, include the missing gtfs-realtime.proto file, and change the GTFS refresh path to validate ZIP entries before extraction.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (32)

Known Vulnerable Dependency: protobufjs==8.0.0 — 12 advisory(ies): CVE-2026-44294 (protobuf.js: Denial of service from crafted field names in generated code); CVE-2026-44293 (protobuf.js: Code injection through bytes field defaults in generated toObject c); CVE-2026-44289 (protobuf.js: Denial of service through unbounded protobuf recursion) +9 more

Critical

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The lockfile includes protobufjs 8.0.0, and the provided advisories describe multiple severe issues including denial of service, recursion abuse, and possible code injection in generated code paths. This is especially relevant for a transit skill that may ingest external GTFS-realtime or other protobuf-formatted data from network sources, making malformed upstream data a plausible attack vector rather than a purely theoretical dependency issue.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: protobufjs==8.0.0 — 12 advisory(ies): CVE-2026-44294 (protobuf.js: Denial of service from crafted field names in generated code); CVE-2026-44293 (protobuf.js: Code injection through bytes field defaults in generated toObject c); CVE-2026-44289 (protobuf.js: Denial of service through unbounded protobuf recursion) +9 more

Critical

• Category: Supply Chain
• Confidence: 94% confidence

Finding

If protobufjs 8.0.0 is affected by the listed advisories, this is a real supply-chain vulnerability because the skill processes GTFS-realtime protobuf data and therefore directly uses the vulnerable parsing/generation library on untrusted transit feed content. In this skill context, parser denial-of-service issues are especially relevant since malformed remote data could crash or hang the skill, and any code-generation/injection flaws would be concerning if those library features are reachable.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md

files: ["scripts/capmetro.mjs", "scripts/gtfs-realtime.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md

files: ["scripts/capmetro.mjs", "scripts/gtfs-realtime.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

md

files: ["scripts/capmetro.mjs", "scripts/gtfs-realtime.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md

files: ["scripts/capmetro.mjs", "scripts/gtfs-realtime.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

md

files: ["scripts/capmetro.mjs", "scripts/gtfs-realtime.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

md

files: ["scripts/capmetro.mjs", "scripts/gtfs-realtime.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

md

files: ["scripts/capmetro.mjs", "scripts/gtfs-realtime.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

md

files: ["scripts/capmetro.mjs", "scripts/gtfs-realtime.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

md

files: ["scripts/capmetro.mjs", "scripts/gtfs-realtime.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md

files: ["scripts/capmetro.mjs", "scripts/gtfs-realtime.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

md

files: ["scripts/capmetro.mjs", "scripts/gtfs-realtime.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

md

files: ["scripts/capmetro.mjs", "scripts/gtfs-realtime.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

md

files: ["scripts/capmetro.mjs", "scripts/gtfs-realtime.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

md

files: ["scripts/capmetro.mjs", "scripts/gtfs-realtime.proto"]

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill explicitly documents network access to multiple external endpoints, but the manifest does not declare any tool scope such as permissions or allowed-tools. This creates a transparency and policy-enforcement gap: consumers may not realize the skill performs network operations, and platforms cannot constrain or review those capabilities accurately.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill invokes the host unzip utility on a ZIP file fetched from a remote endpoint and extracts it directly into a user-writable directory. Even though no shell interpolation is present, relying on an external decompressor for untrusted archive content expands the attack surface and can enable archive-based issues such as zip-slip/path traversal or overwriting unexpected files if malicious entries are ever served.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md

// Feed URLs (Texas Open Data Portal — open access, no key)
// ---------------------------------------------------------------------------
const FEEDS = {
  vehicle_positions_json: 'https://data.texas.gov/download/cuc7-ywmd/text%2Fplain',
  vehicle_positions_pb: 'https://data.texas.gov/download/eiei-9rpf/application%2Foctet-stream',
  trip_updates_pb: 'https://data.texas.gov/download/rmk2-acnw/application%2Foctet-stream',
  service_alerts_pb: 'https://data.texas.gov/download/nusn-7fcn/application%2Foctet-stream',

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md

// Feed URLs (Texas Open Data Portal — open access, no key)
// ---------------------------------------------------------------------------
const FEEDS = {
  vehicle_positions_json: 'https://data.texas.gov/download/cuc7-ywmd/text%2Fplain',
  vehicle_positions_pb: 'https://data.texas.gov/download/eiei-9rpf/application%2Foctet-stream',
  trip_updates_pb: 'https://data.texas.gov/download/rmk2-acnw/application%2Foctet-stream',
  service_alerts_pb: 'https://data.texas.gov/download/nusn-7fcn/application%2Foctet-stream',

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md

// Feed URLs (Texas Open Data Portal — open access, no key)
// ---------------------------------------------------------------------------
const FEEDS = {
  vehicle_positions_json: 'https://data.texas.gov/download/cuc7-ywmd/text%2Fplain',
  vehicle_positions_pb: 'https://data.texas.gov/download/eiei-9rpf/application%2Foctet-stream',
  trip_updates_pb: 'https://data.texas.gov/download/rmk2-acnw/application%2Foctet-stream',
  service_alerts_pb: 'https://data.texas.gov/download/nusn-7fcn/application%2Foctet-stream',

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md

// Feed URLs (Texas Open Data Portal — open access, no key)
// ---------------------------------------------------------------------------
const FEEDS = {
  vehicle_positions_json: 'https://data.texas.gov/download/cuc7-ywmd/text%2Fplain',
  vehicle_positions_pb: 'https://data.texas.gov/download/eiei-9rpf/application%2Foctet-stream',
  trip_updates_pb: 'https://data.texas.gov/download/rmk2-acnw/application%2Foctet-stream',
  service_alerts_pb: 'https://data.texas.gov/download/nusn-7fcn/application%2Foctet-stream',

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md

// Feed URLs (Texas Open Data Portal — open access, no key)
// ---------------------------------------------------------------------------
const FEEDS = {
  vehicle_positions_json: 'https://data.texas.gov/download/cuc7-ywmd/text%2Fplain',
  vehicle_positions_pb: 'https://data.texas.gov/download/eiei-9rpf/application%2Foctet-stream',
  trip_updates_pb: 'https://data.texas.gov/download/rmk2-acnw/application%2Foctet-stream',
  service_alerts_pb: 'https://data.texas.gov/download/nusn-7fcn/application%2Foctet-stream',

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/capmetro.mjs (reported line 26)May include surrounding context.

js

// Feed URLs (Texas Open Data Portal — open access, no key)
// ---------------------------------------------------------------------------
const FEEDS = {
  vehicle_positions_json: 'https://data.texas.gov/download/cuc7-ywmd/text%2Fplain',
  vehicle_positions_pb: 'https://data.texas.gov/download/eiei-9rpf/application%2Foctet-stream',
  trip_updates_pb: 'https://data.texas.gov/download/rmk2-acnw/application%2Foctet-stream',
  service_alerts_pb: 'https://data.texas.gov/download/nusn-7fcn/application%2Foctet-stream',

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/capmetro.mjs (reported line 27)May include surrounding context.

js

// Feed URLs (Texas Open Data Portal — open access, no key)
// ---------------------------------------------------------------------------
const FEEDS = {
  vehicle_positions_json: 'https://data.texas.gov/download/cuc7-ywmd/text%2Fplain',
  vehicle_positions_pb: 'https://data.texas.gov/download/eiei-9rpf/application%2Foctet-stream',
  trip_updates_pb: 'https://data.texas.gov/download/rmk2-acnw/application%2Foctet-stream',
  service_alerts_pb: 'https://data.texas.gov/download/nusn-7fcn/application%2Foctet-stream',

Static analysis

No suspicious patterns detected.