Security audit
Security checks for vulnerabilities and agentic risk
This bus-query skill is mostly purpose-aligned, but it runs an unpinned external npm MCP server with local user privileges, which users should review before installing.
Install only if you are comfortable running the `chelaile-mcp-server` npm package via `npx`. Prefer pinning a reviewed exact version, using native scoped MCP registration where available, and understanding that route, stop, city, and coordinate-related query data will be sent to the transit service.
The skill exposes MCP and shell-like capabilities but does not declare any explicit tool scope such as allowed tools or permissions. That creates an avoidable least-privilege gap: a host agent may permit broader tool execution than the skill actually needs, increasing the blast radius if the skill is misused or later modified.
The manifest description and all user-facing guidance are written exclusively in Chinese, and the skill does not indicate that users may interact in other languages or choose their preferred locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.
The skill instructs spawning npx chelaile-mcp-server without pinning a specific package version. Unpinned remote package execution is a supply-chain risk: a malicious or compromised future release could run arbitrary code in the agent environment when the skill or helper script is used.
The installation command again relies on npx chelaile-mcp-server without an exact version, repeating the same supply-chain exposure in setup instructions. Because this is presented as a standard configuration path, it materially raises the chance that operators will execute unreviewed code from the package registry.
The skill launches a third-party MCP server process without clearly warning the user that external code will be downloaded and executed. This weakens informed consent and increases the chance that users unknowingly run unreviewed code, which is especially relevant here because the package is started automatically during a routine bus query workflow.
The script unconditionally executes an external package via npx -y chelaile-mcp-server, which causes retrieval and execution of code outside the local trust boundary. Even though shell=True is not used and command injection is not present, this still creates a software supply-chain execution risk: a compromised package, typosquatted dependency, or malicious transitive dependency would run with the user's privileges.
class MCPClient:
def __init__(self):
self.proc = subprocess.Popen(
SERVER_CMD, stdin=subprocess.PIPE, stdout=subprocess.PIPE,
stderr=subprocess.DEVNULL, text=True, bufsize=1)
self._id = 0
The script sends user-provided route and stop queries, along with station coordinates returned by the backend workflow, to a network-backed MCP service without explicit disclosure. While this is expected for real-time transit queries, the absence of notice about outbound data transmission can expose user interests, location-related context, and usage metadata to external services without informed consent.
No suspicious patterns detected.