Metra Skill

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:22 PM UTC
• Version: 1.0.0

Overview

This is a disclosed Metra transit-data skill with expected API-key and network use, but its real-time features may be broken until a missing protobuf file and outdated protobuf dependency are fixed.

Before installing, expect the skill to send your Metra API key to Metra's GTFS-RT endpoints and to cache schedule files under ~/.metra/gtfs. The publisher should add the missing gtfs-realtime.proto file and update protobufjs to a patched version before users rely on real-time commands.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (34)

Known Vulnerable Dependency: protobufjs==7.5.4 — 12 advisory(ies): CVE-2026-44294 (protobuf.js: Denial of service from crafted field names in generated code); CVE-2026-44293 (protobuf.js: Code injection through bytes field defaults in generated toObject c); CVE-2026-44289 (protobuf.js: Denial of service through unbounded protobuf recursion) +9 more

Critical

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The skill depends on protobufjs 7.5.4, which is flagged with multiple advisories including denial-of-service from crafted inputs, code generation issues, and potential code injection paths. In a skill that may consume external transit data or protobuf payloads, malformed or attacker-controlled messages could crash the process, trigger unsafe generated-code behavior, or otherwise compromise availability and possibly integrity depending on how codegen features are used.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: protobufjs==7.5.4 — 12 advisory(ies): CVE-2026-44294 (protobuf.js: Denial of service from crafted field names in generated code); CVE-2026-44293 (protobuf.js: Code injection through bytes field defaults in generated toObject c); CVE-2026-44289 (protobuf.js: Denial of service through unbounded protobuf recursion) +9 more

Critical

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The finding indicates resolution to protobufjs 7.5.4, a version with multiple published advisories including denial-of-service and code-injection issues. If this skill parses or generates protobuf data from external Metra feeds or other untrusted inputs, a crafted payload could crash the process, exhaust resources, or potentially trigger unsafe generated-code paths.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 35)May include surrounding context.

Step 2: Set Environment Variable

bash

cp .env.example .env
# Edit .env and add your key:
# METRA_API_KEY=your-key-here

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md

files: ["scripts/metra.mjs", "scripts/gtfs-realtime.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

md

files: ["scripts/metra.mjs", "scripts/gtfs-realtime.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

md

files: ["scripts/metra.mjs", "scripts/gtfs-realtime.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md

files: ["scripts/metra.mjs", "scripts/gtfs-realtime.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

md

files: ["scripts/metra.mjs", "scripts/gtfs-realtime.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

md

files: ["scripts/metra.mjs", "scripts/gtfs-realtime.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

md

files: ["scripts/metra.mjs", "scripts/gtfs-realtime.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

md

files: ["scripts/metra.mjs", "scripts/gtfs-realtime.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md

files: ["scripts/metra.mjs", "scripts/gtfs-realtime.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

md

files: ["scripts/metra.mjs", "scripts/gtfs-realtime.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

md

files: ["scripts/metra.mjs", "scripts/gtfs-realtime.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

md

files: ["scripts/metra.mjs", "scripts/gtfs-realtime.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

md

files: ["scripts/metra.mjs", "scripts/gtfs-realtime.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.

md

files: ["scripts/metra.mjs", "scripts/gtfs-realtime.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.

md

files: ["scripts/metra.mjs", "scripts/gtfs-realtime.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

md

files: ["scripts/metra.mjs", "scripts/gtfs-realtime.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

md

files: ["scripts/metra.mjs", "scripts/gtfs-realtime.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

md

files: ["scripts/metra.mjs", "scripts/gtfs-realtime.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

md

files: ["scripts/metra.mjs", "scripts/gtfs-realtime.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

md

files: ["scripts/metra.mjs", "scripts/gtfs-realtime.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md

files: ["scripts/metra.mjs", "scripts/gtfs-realtime.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

md

files: ["scripts/metra.mjs", "scripts/gtfs-realtime.proto"]

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/metra.mjs:37