ClawHub
Back to skill

Security audit

Mijn HTM

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent local CLI for an HTM account, but it needs careful handling because it uses account credentials and can stage items in the HTM cart.

Install only if you are comfortable running a local Node CLI with your HTM account credentials. Use it only for accounts and passes you own or are authorized to manage, keep HTM_LOGIN/HTM_PASSWORD and birthdate variables out of logs and shared shells, and review the HTM cart in the browser before completing any payment.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill declares that it uses environment variables and network access, but it does not define any explicit tool scope or permission boundaries. That creates an over-privileged execution model where the runtime may allow broader access than users expect, especially dangerous here because the skill handles account credentials and interacts with a live transport account capable of viewing data and initiating purchases.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill requires sensitive credentials (HTM_LOGIN and HTM_PASSWORD) and additionally supports per-pass birthdates, but it provides no warning about secure storage, exposure risk, or privacy implications. In this context, the skill accesses personal travel history and can add products to a cart, so weak guidance around credential handling increases the chance of account compromise or unintended disclosure of personal and financial data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The reorder path performs a mutating purchase-flow action and may transmit sensitive personal data such as birthdate to a remote service, but it provides no explicit interactive warning, confirmation, or clear consent checkpoint at the entry point. In an agent-skill context, that increases the risk of unintended purchases or oversharing of personal data when invoked indirectly or without the user fully understanding that a draft order and cart state will be created server-side.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The header documentation lists available commands as passes, products, reizen, and reorder. Later code exposes an additional regio-advies command in the CLI dispatch, so the inline documentation does not accurately describe what the executable actually supports.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest says the skill fetches passes, products, and trips, and orders new products from the Mijn HTM portal. This file also implements regioAdvies, which reads trip history and performs bundled offline analysis to recommend whether a Regio Vrij subscription is worth it, a materially different advisory feature beyond simple fetching or ordering.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.