Korea metropolitan bus alerts

• Outcome: Review
• Latest audit: Jul 10, 2026 · 2:10 AM UTC
• Version: 1.0.2

Overview

The skill appears legitimate for scheduled Korean bus alerts, but it needs review because its helper can manage all Clawdbot cron jobs and does not actually enforce its DM-only delivery promise.

Install only if you are comfortable letting this skill configure your Clawdbot Gateway environment and create recurring cron jobs. Use a dedicated TAGO API key if possible, verify the generated delivery target is your own DM, and be careful with list/remove because the helper can affect cron jobs outside this bus-alert skill.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill declares powerful capabilities in metadata-like content (`env`, file write, network, shell, service management) but does not expose an explicit permission model to constrain or warn about them. This increases the chance that an agent or user invokes setup and cron-management flows with broader host access than expected, especially because the skill can modify local service configuration and persist secrets.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose is a bus-alert skill, but the content also describes secret storage, systemd override modification, gateway restart, and optional cron registration tooling. That mismatch is dangerous because it obscures the true trust boundary: a user may authorize a harmless-seeming transit skill without realizing it can reconfigure local services and persist credentials, and the claimed DM-only restriction is not inherently enforced by the description itself.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill metadata describes bus-alert creation/management, but the script exposes unrestricted `list` and `remove` operations against the global Clawdbot cron system. If used in a broader agent or shared environment, this can disclose unrelated scheduled jobs and allow deletion of jobs outside the intended bus-alert scope, violating least privilege and enabling cross-skill interference.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The comments state that DM-only delivery is enforced, but the implementation accepts any arbitrary `channel` string and only requires a non-empty `to` value. This mismatch can let a user route automated alert messages to unintended destinations, including non-DM channels if supported by Clawdbot, causing privacy issues or spam in shared spaces.

Session Persistence

Medium

• Category: Rogue Agent

Content

---
name: korea-metropolitan-bus-alerts
description: Create and manage scheduled bus arrival alerts using Korea TAGO (국토교통부) OpenAPI and Clawdbot cron. Use when a user wants to register weekday/weekend schedules like "평일 오전 7시, <정류소명>, <노선들>" and receive automatic arrival summaries via their configured Gateway messaging (DM only).
metadata:
  {
    "openclaw": {

• Confidence: 84% confidence
• Finding: Create and manage scheduled bus arrival alerts using Korea TAGO (국토교통부) OpenAPI and Clawdbot cron. Use when a user wants to register weekday/weekend schedules like "평일 오전 7시, <정류소명>, <노선들>" and receiv

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.