Rail Ticket Helper

• Analyzed: Mar 30, 2026, 9:51 AM
• Findings: 1
• Version: 1.0.0
• Hash: ca85b428ffcdd5bd11e5ce638facd014dc205c6dfc8dde5c6a1508621480ea1f
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill contains hardcoded sensitive identifiers, specifically 'X_APP_ID' and 'EMP_ID', within 'scripts/fb_train_api.py'. While the code appears to legitimately implement train booking functionality via the Fenbeitong OpenAPI (openapiv2.fenbeitong.com), hardcoding these credentials is a significant security vulnerability that could lead to unauthorized account access or session hijacking. There is no evidence of intentional data exfiltration to unauthorized third-party domains, but the use of static employee IDs for all transactions is a high-risk practice.