12306 Train Query

• Verdict: Advisory
• Analyzed: May 10, 2026, 7:15 AM
• Findings: 1
• Version: 1.0.0
• Reason codes:
  suspicious.insecure_tls_verification
• Engine: v2.4.23

Overview

Detected: suspicious.insecure_tls_verification

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI02: Tool Misuse and Exploitation

ConcernHigh Confidence

What this means

Someone able to intercept the network connection could modify train station or availability results, potentially misleading travel decisions.

Why it was flagged

The script disables HTTPS certificate verification when fetching 12306 station data, and the ticket-query options also set rejectUnauthorized: false. This makes the external data source less trustworthy.

Skill content

https.get(url, { rejectUnauthorized: false }, (res) => {

Recommendation

Remove rejectUnauthorized: false and use normal HTTPS certificate validation. Avoid using this script for account login or purchases unless the TLS handling is fixed.

Findings (1)

warn

suspicious.insecure_tls_verification

• Location: scripts/train_query.js:21
• Finding: HTTPS certificate verification is disabled.