ClawHub
Back to skill

Security audit

UK Trains

Security checks for vulnerabilities and agentic risk

Overview

This train-times skill has a legitimate purpose, but one included helper script can send the National Rail token to an environment-selected endpoint.

Review this before installing. The Python command path appears purpose-aligned, but avoid using scripts/trains.sh unless you trust and control the HUXLEY_URL environment; rotate the National Rail token if it may have been used with an untrusted endpoint. Prefer a version that removes the endpoint override or validates it against trusted HTTPS origins and avoids putting tokens in URLs.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/trains.sh:7
Finding

Arbitrary Huxley2 Endpoint Override Can Disclose the National Rail API Token

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Tainted flow: 'req' from os.environ.get (line 39, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/trains.py (reported line 49)May include surrounding context.

python
)
    
    try:
        with urllib.request.urlopen(req, timeout=30) as resp:
            return resp.read().decode('utf-8')
    except HTTPError as e:
        print(json.dumps({'error': f'HTTP {e.code}: {e.reason}'}), file=sys.stderr)

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding

The skill description claims behavior that does not match the detected implementation, including using a different API path and overstating station-search coverage. Description-behavior mismatches are dangerous because they undermine trust, impair review, and can hide undeclared data flows or unsupported edge cases that operators and users rely on when granting access or making decisions.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill appears to require environment access, network access, and shell execution, but it does not declare any explicit tool scope or permissions. That makes the skill's operational privileges opaque to the host and reviewers, increasing the risk of over-broad execution, accidental secret exposure, or unintended command/network use beyond the stated train-query purpose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.