NYC MTA Transit

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:01 PM UTC
• Version: 1.0.0

Overview

The skill is purpose-aligned for NYC transit lookup, but it has enough credential, privacy, dependency, and unsafe download concerns that users should review it before installing.

Review this skill before installing. It appears to perform the advertised transit functions, but avoid using a sensitive or shared MTA BusTime key until error logging is redacted, be aware that nearby bus searches send coordinates to MTA, and prefer a version that updates protobufjs and validates the GTFS ZIP before extraction.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/mta.mjs:281

Finding

Bus API Key Disclosed Through HTTP Error Messages

Content

View full analysis

{ if (err.name === 'TimeoutError' || err.message?.includes('timeout')) { console.error('Request timed out. MTA feed may be slow or unreachable. Try again in a moment.'); } else if (err.code === 'ENOTFOUND' || err.code === 'ECONNREFUSED') { console.error('Network error: Could not reach MTA API. Check your internet connection.'); } else { console.error(`Error: ${err.message}`); } process.exit(1); }); ``` The same credential-bearing URL pattern is also used at: - `scripts/mta.mjs:826-827` - `scripts/mta.mjs:980-981` - `scripts/mta.mjs:1068-1069` - `scripts/mta.mjs:1088-1096` ### Technical Analysis The MTA BusTime API credential is transmitted as the `key` query parameter. Although sending the key to the declared official MTA HTTPS endpoint is necessary for bus functionality, the implementation passes the complete URL to `fetchJSON()` and includes that URL verbatim in exceptions generated for non-success HTTP responses. The top-level exception handler subsequently prints `err ...[truncated 1471 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/mta.mjs:484

Finding

Unauthenticated GTFS Archive Downloaded and Extracted Without Integrity Verification

Content

View full analysis

f.endsWith('.txt')).sort(); console.log(`Extracted ${files.length} files:`); for (const f of files) console.log(` ${f}`); console.log('GTFS data refreshed successfully.'); } ``` ### Technical Analysis The static GTFS ZIP archive is downloaded over plain HTTP. HTTP does not authenticate the remote server or protect response integrity, so an attacker capable of intercepting or modifying network traffic can replace the archive. The implementation does not verify a trusted digest or digital signature. It also invokes the system `unzip` utility directly against the downloaded archive without first validating archive entry names, file types, total extracted size, or the expected GTFS file set. Using `execFileSync()` with an argument ...[truncated 1753 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (36)

Known Vulnerable Dependency: protobufjs==7.5.4 — 12 advisory(ies): CVE-2026-44294 (protobuf.js: Denial of service from crafted field names in generated code); CVE-2026-44293 (protobuf.js: Code injection through bytes field defaults in generated toObject c); CVE-2026-44289 (protobuf.js: Denial of service through unbounded protobuf recursion) +9 more

Critical

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The lockfile pins protobufjs 7.5.4, which the scanner associates with multiple advisories including code injection and denial-of-service issues. In an MTA transit skill, protobuf parsing is plausibly used to consume GTFS-realtime feeds or other external transit data, which increases risk because untrusted remote data could trigger parser flaws, recursion-based DoS, or unsafe generated-code paths if code generation features are used.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: protobufjs==7.5.4 — 12 advisory(ies): CVE-2026-44294 (protobuf.js: Denial of service from crafted field names in generated code); CVE-2026-44293 (protobuf.js: Code injection through bytes field defaults in generated toObject c); CVE-2026-44289 (protobuf.js: Denial of service through unbounded protobuf recursion) +9 more

Critical

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The package depends on protobufjs, and the finding indicates resolution to a known vulnerable version with multiple advisories, including denial-of-service, code injection in generated code paths, and unbounded recursion issues. Because this skill processes real-time transit data and may parse untrusted protobuf payloads from remote sources, the skill context increases risk: malformed upstream data or MITM/compromised feeds could trigger crashes or potentially unsafe code-generation-related behavior.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md

files: ["scripts/mta.mjs", "proto/gtfs-realtime.proto", "proto/nyct-subway.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

md

files: ["scripts/mta.mjs", "proto/gtfs-realtime.proto", "proto/nyct-subway.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md

files: ["scripts/mta.mjs", "proto/gtfs-realtime.proto", "proto/nyct-subway.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

md

files: ["scripts/mta.mjs", "proto/gtfs-realtime.proto", "proto/nyct-subway.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

md

files: ["scripts/mta.mjs", "proto/gtfs-realtime.proto", "proto/nyct-subway.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

md

files: ["scripts/mta.mjs", "proto/gtfs-realtime.proto", "proto/nyct-subway.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

md

files: ["scripts/mta.mjs", "proto/gtfs-realtime.proto", "proto/nyct-subway.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

md

files: ["scripts/mta.mjs", "proto/gtfs-realtime.proto", "proto/nyct-subway.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.

md

files: ["scripts/mta.mjs", "proto/gtfs-realtime.proto", "proto/nyct-subway.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

md

files: ["scripts/mta.mjs", "proto/gtfs-realtime.proto", "proto/nyct-subway.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

md

files: ["scripts/mta.mjs", "proto/gtfs-realtime.proto", "proto/nyct-subway.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

md

files: ["scripts/mta.mjs", "proto/gtfs-realtime.proto", "proto/nyct-subway.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

md

files: ["scripts/mta.mjs", "proto/gtfs-realtime.proto", "proto/nyct-subway.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

md

files: ["scripts/mta.mjs", "proto/gtfs-realtime.proto", "proto/nyct-subway.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md

files: ["scripts/mta.mjs", "proto/gtfs-realtime.proto", "proto/nyct-subway.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

md

files: ["scripts/mta.mjs", "proto/gtfs-realtime.proto", "proto/nyct-subway.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

md

files: ["scripts/mta.mjs", "proto/gtfs-realtime.proto", "proto/nyct-subway.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

md

files: ["scripts/mta.mjs", "proto/gtfs-realtime.proto", "proto/nyct-subway.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

md

files: ["scripts/mta.mjs", "proto/gtfs-realtime.proto", "proto/nyct-subway.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

md

files: ["scripts/mta.mjs", "proto/gtfs-realtime.proto", "proto/nyct-subway.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

md

files: ["scripts/mta.mjs", "proto/gtfs-realtime.proto", "proto/nyct-subway.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.

md

files: ["scripts/mta.mjs", "proto/gtfs-realtime.proto", "proto/nyct-subway.proto"]

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

md

files: ["scripts/mta.mjs", "proto/gtfs-realtime.proto", "proto/nyct-subway.proto"]

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/mta.mjs:38