Youbike Mcp

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 12:47 AM UTC
• Version: 1.0.2

Overview

This is a read-only YouBike lookup skill using public data feeds; its main risk is dependency hygiene, not hidden or malicious behavior.

Install only if you are comfortable with a Node-based MCP server making outbound requests to the listed public YouBike data APIs. Before broad deployment, update or pin dependencies to patched versions and consider removing the husky prepare script from the published runtime package.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (24)

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: axios 1.13.6 is a direct dependency and the advisory set includes SSRF, redirect/header handling, and prototype-pollution-related issues. This skill fetches real-time YouBike data and supports user-driven search inputs, so any outbound HTTP logic built on axios increases the chance that a vulnerable request path could be reached, especially if URLs, proxy settings, or redirects are influenced by configuration or upstream responses.

Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more

High

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: fast-uri 3.1.0 is a transitive dependency of ajv and is flagged for host confusion and SSRF-related URI parsing flaws. If the application or SDK uses URI validation/parsing as a security boundary, malformed attacker input could be misclassified as safe, though the lockfile alone does not prove those specific paths are reachable in this YouBike lookup skill.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 80% confidence
• Finding: form-data 4.0.5 is affected by CRLF injection in multipart field names and filenames. This skill appears to be a read-only bike-status lookup service and the lockfile alone shows no evidence of multipart upload generation, so the package is vulnerable but likely not meaningfully exposed in this specific context.

Known Vulnerable Dependency: hono==4.12.7 — 16 advisory(ies): CVE-2026-56762 (Hono missing validation of cookie name on write path in setCookie()); CVE-2026-47676 (Hono: app.mount() strips mount prefix using undecoded path, causing incorrect ro); CVE-2026-47675 (Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie) +13 more

High

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: hono 4.12.7 is present as part of the MCP SDK stack and has multiple advisories affecting cookies, routing, and request handling. Because MCP/network-facing skills often expose HTTP endpoints or transports, framework-level flaws can become reachable even in otherwise simple applications, though the exact exploitability depends on which Hono features the skill actually uses.

Known Vulnerable Dependency: ip-address==10.1.0 — 2 advisory(ies): CVE-2026-69192 (ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco); CVE-2026-42338 (ip-address has XSS in Address6 HTML-emitting methods)

High

• Category: Supply Chain
• Confidence: 80% confidence
• Finding: ip-address 10.1.0 is pulled in by express-rate-limit and is flagged for parsing ambiguity and XSS in HTML-emitting helpers. In this skill, it is an indirect dependency and there is no indication the application renders Address6 HTML methods or makes security decisions on ambiguous IPv4 literals directly, so real-world impact appears limited from the available evidence.

Known Vulnerable Dependency: path-to-regexp==8.3.0 — 2 advisory(ies): CVE-2026-4923 (path-to-regexp vulnerable to Regular Expression Denial of Service via multiple w); CVE-2026-4926 (path-to-regexp vulnerable to Denial of Service via sequential optional groups)

High

• Category: Supply Chain
• Confidence: 83% confidence
• Finding: path-to-regexp 8.3.0 is flagged for ReDoS/DoS via crafted route patterns. As a transitive dependency of router/express in the SDK stack, risk is moderate for any exposed HTTP routing layer because pathological path matching can consume CPU, although exploitation usually depends on vulnerable route definitions being present.

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: The skill depends on axios 1.13.6, which the finding indicates has multiple published advisories, including SSRF-related and interception/prototype-pollution-adjacent issues. Because this skill likely performs outbound HTTP requests to retrieve real-time YouBike station data, a vulnerable HTTP client is more dangerous here than in a non-networked package: malformed proxy settings, redirects, or attacker-influenced request handling could expose internal services, credentials, or response integrity.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The tool call is fixed to a Taiwan-specific city value ("桃園市") and uses Chinese-language content without offering any user choice or documenting that the skill is intentionally region-specific. This can violate language/locale policy expectations because the behavior is constrained to a particular locale by default rather than through explicit opt-in.

External Transmission

Medium

• Category: Data Exfiltration

Content

const API_CONFIG = {
  taipei: "https://tcgbusfs.blob.core.windows.net/dotapp/youbike/v2/youbike_immediate.json",
  new_taipei: "https://data.ntpc.gov.tw/api/datasets/010e5b15-3823-4b20-b401-b1cf000550c5/json?size=2000",
  taoyuan: "https://opendata.tycg.gov.tw/api/v1/dataset.api_access?rid=08274d61-edbe-419d-8fcc-7a643831283d&format=json&limit=2000"
};

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

const API_CONFIG = {
  taipei: "https://tcgbusfs.blob.core.windows.net/dotapp/youbike/v2/youbike_immediate.json",
  new_taipei: "https://data.ntpc.gov.tw/api/datasets/010e5b15-3823-4b20-b401-b1cf000550c5/json?size=2000",
  taoyuan: "https://opendata.tycg.gov.tw/api/v1/dataset.api_access?rid=08274d61-edbe-419d-8fcc-7a643831283d&format=json&limit=2000"
};

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The natural-language interface exposed by the tool uses Chinese-only descriptions and examples, with no indication that other languages are supported or that the locale restriction is intentional. This can violate language/locale policy when a skill forces a specific language without user opt-in or documented justification.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: The natural-language content describing the skill’s purpose and usage is presented entirely in Chinese, and the file does not offer an alternative language or indicate that the language choice is optional. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Known Vulnerable Dependency: @hono/node-server==1.19.11 — 2 advisory(ies): CVE-2026-39406 (@hono/node-server: Middleware bypass via repeated slashes in serveStatic); GHSA-frvp-7c67-39w9 (Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encode)

Low

• Category: Supply Chain
• Confidence: 84% confidence
• Finding: The lockfile pins @hono/node-server 1.19.11, and the cited advisories describe middleware bypass and Windows path traversal in static file serving. In this skill's context, the package is present transitively via the MCP SDK and there is no direct evidence this skill exposes static files, so exploitability depends on unused server features being enabled; however, keeping a known vulnerable server adapter in production dependencies is still a real supply-chain risk.

Known Vulnerable Dependency: body-parser==2.2.2 — 1 advisory(ies): CVE-2026-12590 (body-parser vulnerable to denial of service when invalid limit value silently di)

Low

• Category: Supply Chain
• Confidence: 78% confidence
• Finding: body-parser 2.2.2 is flagged for a denial-of-service condition involving invalid limit handling. In this repository it is transitive through express/MCP SDK, and there is no evidence from the lockfile alone that this skill parses attacker-controlled large request bodies in a vulnerable configuration, so the practical risk appears limited but the dependency remains known-vulnerable.

Known Vulnerable Dependency: follow-redirects==1.15.11 — 1 advisory(ies): CVE-2026-40895 (follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Ta)

Low

• Category: Supply Chain
• Confidence: 86% confidence
• Finding: follow-redirects 1.15.11 is bundled under axios and is flagged for leaking custom authentication headers across cross-domain redirects. Even if this skill mainly consumes public transport data, redirect-based credential leakage becomes dangerous if future deployments add API keys, bearer tokens, or internal headers to outbound requests.

Known Vulnerable Dependency: qs==6.15.0 — 3 advisory(ies): CVE-2026-82417 (qs: Denial of Service via Attacker Controlled isBuffer); CVE-2026-8723 (qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/u); CVE-2026-82562 (qs array-limit bypass via bracket-key comma parsing)

Low

• Category: Supply Chain
• Confidence: 80% confidence
• Finding: qs 6.15.0 has multiple denial-of-service issues and is commonly used for querystring parsing in express stacks. Since this skill supports keyword and nearby searches, attacker-controlled query parameters are plausible, but the known issues are mostly availability-focused and their exploitability depends on whether the service actually exposes HTTP query parsing through affected middleware.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"author": "",
  "license": "ISC",
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.27.1",
    "axios": "^1.13.6",
    "zod": "^4.3.6"
  },

• Confidence: 91% confidence
• Finding: The dependency uses a caret version range, which allows newer compatible releases to be installed over time. This weakens build reproducibility and can introduce unexpected or compromised upstream changes through the supply chain, though by itself it is not an immediately exploitable flaw in the skill logic.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"license": "ISC",
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.27.1",
    "axios": "^1.13.6",
    "zod": "^4.3.6"
  },
  "devDependencies": {

• Confidence: 95% confidence
• Finding: The axios dependency is specified with a caret range, so installs may resolve to different releases depending on time and environment. In a network-facing MCP skill, that increases supply-chain risk and operational unpredictability, especially because HTTP client behavior is security-sensitive.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"dependencies": {
    "@modelcontextprotocol/sdk": "^1.27.1",
    "axios": "^1.13.6",
    "zod": "^4.3.6"
  },
  "devDependencies": {
    "husky": "^9.1.7"

• Confidence: 88% confidence
• Finding: The zod dependency is not pinned exactly, allowing semver-compatible updates to be pulled in automatically. While this is common practice, it still creates avoidable supply-chain and reproducibility risk if a bad release or malicious publish occurs.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"zod": "^4.3.6"
  },
  "devDependencies": {
    "husky": "^9.1.7"
  }
}

• Confidence: 82% confidence
• Finding: The husky devDependency is also unpinned, which can affect developer and CI environments during prepare hook execution. Although lower risk than a runtime dependency, developer-tool supply-chain compromise can still lead to code execution during install workflows.

Natural-Language Policy Violations

Low

• Confidence: 79% confidence
• Finding: The code hard-codes the city name as "新北市", which bakes a specific locale/language choice into the skill behavior. Because there is no indication that the user can choose or override the locale, this may conflict with a policy requiring language or locale choice unless the tool is explicitly region-specific.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The code launches a separate Node.js process via StdioClientTransport using the command and args fields, but there is no confirmation prompt, user-facing log, or explanatory comment/docstring disclosing that a subprocess will be started. Because this is a code file, shell/subprocess execution should have some visible warning unless it is clearly disclosed elsewhere in the skill description, which is not present in this file.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The skill performs outbound HTTP requests to external YouBike/open-data endpoints via axios.get, but the code provides no confirmation prompt, logging, or explanatory comment/docstring disclosing that user-supplied location context will be used to query remote services. For a code file, network calls that transmit user or system data should have some visible disclosure unless clearly documented elsewhere.

Natural-Language Policy Violations

Low

• Confidence: 85% confidence
• Finding: The script uses only Traditional Chinese city names in its natural-language values, which reflects a locale-specific constraint without any visible user opt-in or explanation. Under the policy rule for language or locale constraints, this can be considered a natural-language policy issue because the file bakes in one locale as the only supported mode.

Static analysis

No suspicious patterns detected.