Irail

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 6:42 PM UTC
• Version: 1.0.1

Overview

This skill is a coherent Belgian railway CLI helper, with disclosed public API use and no artifact-backed evidence of hidden data access, persistence, or destructive behavior.

Install only if you are comfortable relying on the dedene irail CLI and its package sources. Prefer checking the upstream project and installed version before use, and keep queries limited to Belgian rail information you are comfortable sending to the public iRail service.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned Third-Party CLI Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15-23 and line 243
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

The skill directs the environment to install the irail executable from mutable third-party Homebrew and Go sources without specifying an immutable version, commit, checksum, or signature.

yaml

metadata:
  author: dedene
  version: "1.1.0"
  openclaw:
    requires:
      bins:
        - irail
      anyBins:
        - jq
    install:
      - kind: brew
        tap: dedene/tap
        formula: irail
        bins: [irail]
      - kind: go
        package: github.com/dedene/irail-cli/cmd/irail
        bins: [irail]

The installation section repeats the mutable Homebrew installation command:

bash

brew install dedene/tap/irail

Technical Analysis

The skill package contains documentation only and does not include the implementation of the executable it invokes. Consequently, the behavior reviewed in SKILL.md cannot guarantee the behavior of the subsequently installed irail binary.

Neither installation method identifies an immutable release:

• The Homebrew formula is obtained from the mutable third-party tap dedene/tap.
• The Go package path has no version or commit suffix.
• No checksum, cryptographic signature, provenance attestation, or expected artifact digest is documented.
• The skill metadata version (1.1.0) does not pin or verify the installed dependency version.

If an upstream repository, release process, maintainer account, or package-distribution channel is compromised, a modified dependency could be delivered after this skill has already passed review.

Attack Path

1. An attacker compromises the upstream Homebrew tap, Go repository, maintainer credentials, or release pipeline.
2. The attacker publishes a modified formula, source revision, or dependency containing malicious inst ...[truncated 1238 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the Go dependency to an immutable, reviewed version or commit rather than using an unversioned package path.
2. Pin the Homebrew formula to a reviewed release and avoid relying solely on the mutable head of a third-party tap.
3. Publish and verify cryptographic checksums or signatures for downloaded artifacts before execution.
4. Prefer reproducible, signed releases with provenance attestations from a trusted build pipeline.
5. Ensure the dependency version declared by the installation mechanism matches the skill metadata version.
6. Document the expected binary version and verify it after installation, for example by checking irail --version.
7. Run installation and normal CLI operations with least privilege in a restricted environment; do not install as an administrator unless strictly necessary.
8. Periodically review the pinned upstream revision and update it only after source and release-artifact verification.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md

# irail-cli

CLI for Belgian railways (NMBS/SNCB) via [iRail API](https://api.irail.be/). No authentication required.

## Quick Start

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The description says the skill is triggered by mentions of Belgian trains, train schedules, or railway delays, but it does not define exclusions or narrower invocation conditions. While partly domain-specific, the trigger scope remains ambiguous enough that ordinary travel-related conversation could invoke the skill unintentionally.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.