ClawHub
Back to skill

Security audit

12306 Old

Security checks for vulnerabilities and agentic risk

Overview

This 12306 ticketing skill is not overtly malicious, but it under-discloses sensitive account/session handling and stores browser cookies in plaintext.

Review before installing. This skill may open a browser session for a real 12306 account and can save session cookies as a local plaintext file named 12306_cookies.json. Use only in a private workspace, avoid committing or sharing generated cookie files, and require explicit user confirmation before any real account or purchase-related action.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
12306_client.py:48
Finding

Authentication Session Cookies Stored in Plaintext

Content
View full analysis

Vulnerability Details

File Location: 12306_client.py:48-51
Vulnerability Type: Plaintext storage of sensitive authentication data
Risk Level: Medium

Vulnerable Code

python
def save_cookies(self):
    try:
        with open(self.cookie_file, "w", encoding="utf-8") as f:
            json.dump(self.page.context.cookies(), f, ensure_ascii=False, indent=2)
    except:
        pass

Technical Analysis

The client serializes the complete Playwright browser cookie set to a plaintext JSON file. The default path is the relative filename 12306_cookies.json, and the file is created with permissions determined by the process umask rather than explicitly enforced owner-only permissions.

Authentication cookies may function as bearer credentials. Any user or process able to read the cookie file may be able to reuse a still-valid authenticated session without knowing the account password. A relative, caller-controlled path also increases the likelihood that the file will be created in a shared directory, included in a backup, or accidentally committed to source control.

The bare exception handler suppresses all storage failures, preventing callers from detecting insecure or unsuccessful persistence.

Attack Path

  1. A victim starts the client and authenticates with the 12306 website.
  2. login() invokes save_cookies(), which retrieves all cookies from the browser context.
  3. The cookies are written unencrypted to 12306_cookies.json or another caller-supplied path.
  4. An attacker with local read access, access to a shared workspace, backup, artifact archive, or mistakenly committed file obtains the JSON file.
  5. The attacker imports any still-valid authentication cookies into a compatible browser context.
  6. If the service accepts the copied session, the attacker impersonates the victim until the session expires or is revoked.

Exploitation requires access to the generated cookie file a ...[truncated 436 chars]

Remediation
View remediation

Remediation Suggestions

  • Prefer an operating-system credential store or encrypted secret-storage facility rather than a plaintext JSON file.
  • If file persistence is unavoidable, store cookies in a private per-user application-data directory.
  • Create the file atomically with owner-only permissions, such as mode 0600 on POSIX systems.
  • Reject symbolic links and avoid writing through attacker-controlled paths.
  • Document that the file contains authentication material and add it to .gitignore.
  • Delete the cookie file during logout and when the session is invalid or expired.
  • Minimize persisted data by retaining only cookies strictly required for session restoration.
  • Replace the bare except clause with specific exception handling and report failures securely without exposing cookie values.

T09 · Insecure Skill Coding Practices

Warning
Location
12306-old/12306_client.py:48
Finding

Legacy Client Also Stores Authentication Session Cookies in Plaintext

Content
View full analysis

Vulnerability Details

File Location: 12306-old/12306_client.py:48-51
Vulnerability Type: Plaintext storage of sensitive authentication data
Risk Level: Medium

Vulnerable Code

python
def save_cookies(self):
    try:
        with open(self.cookie_file, "w", encoding="utf-8") as f:
            json.dump(self.page.context.cookies(), f, ensure_ascii=False, indent=2)
    except:
        pass

Technical Analysis

The legacy client duplicates the active client's insecure cookie-persistence implementation. It writes the complete browser cookie set to plaintext using process-default filesystem permissions and a relative path by default.

Keeping a second vulnerable implementation increases the chance that users invoke or redistribute the insecure legacy version after the primary version is fixed. Because cookies may operate as bearer credentials, disclosure can enable session replay without disclosure of the account password.

Attack Path

  1. A victim runs the legacy client and authenticates with the 12306 website.
  2. The legacy login() method invokes save_cookies().
  3. Authentication cookies are serialized to an unencrypted JSON file.
  4. An attacker obtains the file through local access, a shared directory, backup exposure, build artifacts, or accidental source-control inclusion.
  5. The attacker imports still-valid cookies into another browser context.
  6. If accepted by the service, the attacker reuses the victim's authenticated session.

Exploitation requires disclosure of the generated file and a session that remains valid and reusable.

Impact Assessment

Successful exploitation could provide unauthorized access equivalent to the victim's captured 12306 session. The scope is limited by the account's permissions, session lifetime, and server-side session protections. No operating-system privilege escalation or arbitrary code execution results directly from this flaw.

Remediation
View remediation

Remediation Suggestions

  • Remove the obsolete duplicate if it is not required.
  • If retained, apply the same secure-storage changes as in the active client.
  • Use an OS-backed credential store or encrypted storage.
  • Enforce owner-only permissions and a private per-user storage directory.
  • Prevent symbolic-link traversal and unsafe caller-controlled destinations.
  • Exclude cookie files from source control, build artifacts, and backups where feasible.
  • Remove stale cookies on logout or expiration.
  • Replace broad exception suppression with explicit, securely reported error handling.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (14)

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module/class documentation presents this as a '12306 ticket-purchase automation client', and the code accepts username/password fields, implying active login automation. However, the login method never uses the provided credentials or fills/submits a login form; it only loads cookies, opens the login page, saves cookies, and checks page content for logged-in state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The code reads sensitive credentials from environment variables for the 12306 account, but there is no confirmation prompt, visible log message, or explanatory comment/docstring warning the user that account secrets will be accessed. In this file, the top-level docstrings only describe ticket automation and do not disclose credential handling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The client persists browser session cookies to a local JSON file without any access controls, encryption, or warning to the user. If that file is read by another local user, malware, or accidentally committed/shared, an attacker may be able to reuse the session and impersonate the account on the railway service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README advertises automated login, ticket search, and ticket purchase against a real railway booking service without any warning about account use, unintended purchases, rate limits, or terms-of-service implications. Documentation that normalizes account- and transaction-impacting automation can cause operators to run the tool without understanding that it may spend money, lock accounts, or mishandle credentials.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The module and class docstrings describe this as a '12306 ticket-purchase automation client', which implies the client performs automated login/purchase actions. However, the login flow in login() only navigates to the login page, waits, saves cookies, and checks whether a session already exists; it never fills username/password or submits credentials despite accepting them in __init__. This is an intent-level contradiction between the documented purpose and the implemented behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The code loads the 12306 username and password from environment variables, which is access to sensitive credentials. Aside from the class docstring naming the client, there is no confirmation prompt, comment, or user-facing disclosure explaining that account credentials will be read from the environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code persists browser session cookies to a JSON file on disk without any access control, encryption, or warning to the user. If that file is readable by other local users, included in backups, or accidentally committed/shared, an attacker may be able to reuse authenticated session data and hijack the user's 12306 session.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The README explicitly promotes automated login and ticket purchasing for a real ticketing platform but provides no warning that the tool can perform account-affecting and purchase-triggering actions. In an agent or automation context, this increases the risk of unintended transactions, misuse of stored credentials, or operation against platform rules without informed user consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill documentation is overly generic and does not define clear activation scope, intended inputs, or operational boundaries. For a skill apparently related to 12306 login/client functionality, this ambiguity can cause over-broad invocation and misuse, especially around credential-handling or account actions, because users and orchestrators are not told when the skill should or should not run.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation points users to environment variables without warning that these may include sensitive credentials, tokens, or personal account data. In the context of a 12306 client/login skill, this increases the likelihood that operators will place railway account credentials in insecure locations, mishandle secrets, or expose them through logs, examples, or shared development environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

This markdown file says to check .env.example for required environment variables, which implies the skill may use credentials or other sensitive configuration, but it provides no warning about handling sensitive data or privacy implications. Under the markdown variant of SQP-2, skill descriptions should disclose behaviours that could affect user data or credentials.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest only says "12306 skill package," which provides no specific trigger scope, activation conditions, or constraints for when the skill should be used. In a manifest file, this lack of specificity can lead to ambiguous or overly broad invocation matching because there are no clear positive or negative examples.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The natural-language content appears to require Chinese comprehension and does not indicate that the user can select another language. Under the stated policy, forcing a specific language without opt-in is a locale-policy concern unless the restriction is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script prints a success message only in Chinese ("登录成功") and provides no option for the user to select a preferred language. For a general-purpose login script, this is a natural-language locale policy issue unless the regional/language restriction is explicitly documented.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.