alltrails-fpx

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 3:03 AM UTC
• Version: 2.3.3

Overview

This skill is a read-only AllTrails shell workflow that clearly discloses its browser-session access, though users should be careful with the global CLI install and personal activity data.

Install only if you are comfortable pairing fpx/Transporter with an AllTrails browser session. Prefer a pinned or local @fetchproxy/cli install, restrict the extension to alltrails.com, avoid storing captured session output in predictable temp files, and treat saved lists, completed trails, and activity feed data as personal information.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:33
• Finding: Unpinned Global Installation of a Privileged Third-Party CLI## Vulnerability Details **File Location**: `SKILL.md`, line 33 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium **Complete Code Snippet**: ```sh npm install -g @fetchproxy/cli # provides `fpx` ``` ### Technical Analysis The setup command globally installs the latest available release of `@fetchproxy/cli` without pinning an exact version or verifying package integrity. npm packages may execute lifecycle scripts during installation, so this creates a mutable supply-chain execution path with the privileges of the user running the command. The installed CLI is subsequently paired with a browser extension and used to issue same-origin requests from a signed-in AllTrails browser tab. As a result, compromise of a future package release could affect both the local environment and authenticated browser-mediated operations. The audit found no evidence that the currently referenced package is malicious; the vulnerability is the unsafe, unpinned installation practice. ### Attack Path 1. An attacker compromises the npm package, a maintainer account, or a future package release. 2. A user follows the documented setup command after the compromised release becomes current. 3. npm downloads the mutable latest version and may execute its installation lifecycle scripts. 4. The compromised package obtains code execution with the installing user's privileges. 5. When paired and used, it may also abuse its role in the browser bridge to observe or manipulate authenticated requests and returned data. ### Impact Assessment Successful exploitation could execute arbitrary code under the installing user's account. This may expose user-accessible files, environment variables, and other local credentials. Because the CLI participates in requests through a signed-in browser tab, it could potentially misuse browser-mediated access within the permissions granted to the associated extension and profile. ...[truncated 166 chars]
• Remediation: ## Remediation Suggestions - Pin `@fetchproxy/cli` to an exact, reviewed version rather than installing the latest release. - Record and verify the expected package integrity hash and official package provenance. - Prefer a project-local installation with a lockfile over a global installation. - Avoid running npm or the CLI with administrative privileges. - Use `--ignore-scripts` during installation unless lifecycle scripts are demonstrably required and have been audited. - Document a controlled upgrade process that reviews package changes before updating the pinned version. - Grant the paired extension and profile only the minimum required domain access.

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:63
• Finding: Captured Header Data Written to a Predictable Shared Temporary Path## Vulnerability Details **File Location**: `SKILL.md`, lines 63-65 **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: Low **Complete Code Snippet**: ```sh fpx session -p alltrails > /tmp/at.json & # opens the capture window sleep 1 && open 'https://www.alltrails.com/explore' # or reload the open tab wait && AT_KEY=$(jq -r '.capturedHeaders["x-at-key"] // empty' /tmp/at.json) ``` ### Technical Analysis Session output containing captured header material is redirected to the fixed path `/tmp/at.json`. Shared temporary directories are commonly writable by other local users. The example does not securely create the file, enforce restrictive permissions, reject symbolic links, verify ownership, or remove the file afterward. A local attacker may pre-create the path as a symbolic link, monitor the predictable file, or attempt to replace its contents before `jq` reads it. Depending on operating-system protections and file ownership, this could cause an unintended user-writable file to be truncated, disclose captured data, or make the workflow consume attacker-controlled header content. The documented `x-at-key` is characterized as a static anonymous client identifier rather than an account credential, which limits the direct confidentiality impact. Nevertheless, the session output may include all declared captured headers, and retaining it at a predictable shared path is an unsafe temporary-file practice. ### Attack Path 1. A local attacker with access to the shared temporary directory predicts the `/tmp/at.json` path. 2. Before the victim runs the example, the attacker creates a symbolic link at that path to another file writable by the victim, or prepares to monitor and replace the file. 3. The victim runs `fpx session -p alltrails > /tmp/at.json`. 4. The redirection may truncate the symlink target, or the resulting captured session data may become available to the attacker. 5. The attacker ...[truncated 648 chars]
• Remediation: ## Remediation Suggestions Create a unique temporary file with restrictive permissions and guarantee cleanup: ```sh umask 077 tmp=$(mktemp "${TMPDIR:-/tmp}/alltrails-session.XXXXXX") || exit 1 trap 'rm -f -- "$tmp"' EXIT HUP INT TERM fpx session -p alltrails >"$tmp" & capture_pid=$! sleep 1 open 'https://www.alltrails.com/explore' wait "$capture_pid" || exit 1 AT_KEY=$(jq -er '.capturedHeaders["x-at-key"] | select(type == "string" and length > 0)' "$tmp") || exit 1 ``` Additionally: - Do not use a fixed filename in a shared temporary directory. - Validate the temporary file's ownership and type before reading it. - Keep the restrictive `umask` in effect when captured session data is written. - Delete the file immediately after extracting the required value. - Avoid writing session output to disk at all if the CLI supports a secure pipeline that preserves the required capture timing and error handling.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill explicitly enables access to signed-in user data such as saved lists, completed trails, and activity feed, but it does not prominently warn that personal account data will be queried through the user’s authenticated browser session. In a shell/script context, this can lead to unintentional collection or disclosure of private account information because users may assume they are only fetching public trail data.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document explicitly shows how to query signed-in user data and other users' lists, completed trails, and activity feeds, but provides no privacy, authorization, or data-handling guidance. In a shell automation skill, this can normalize collection or redistribution of account-linked personal activity data without ensuring the operator has consent or understands whether the data is public versus private.

Natural-Language Policy Violations

Low

• Confidence: 96% confidence
• Finding: The examples instruct callers to send `x-language-locale: en-US`, and the text states defaults match `ALLTRAILS_LOCALE`, but no user opt-in or rationale for forcing `en-US` is provided. This can violate language/locale policy by imposing a specific locale by default.

Natural-Language Policy Violations

Low

• Confidence: 96% confidence
• Finding: This example again specifies `x-language-locale: en-US`, reinforcing a fixed locale expectation. Without an explicit opt-in, configurability, or region-specific justification, this is a natural-language locale policy concern.

Natural-Language Policy Violations

Low

• Confidence: 98% confidence
• Finding: The header example sets `x-language-locale: en-US` as a fixed value in natural-language-facing usage guidance. This imposes a specific language/locale without opt-in, which matches the stated policy violation criteria for locale constraints.

Static analysis

No suspicious patterns detected.