HK Transit ETA

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:27 PM UTC
• Version:
  1.0.1

Overview

This is a coherent Hong Kong transit ETA helper that only appears to query official transport data services for user-requested routes and stations.

Install this only if you are comfortable running a bundled Python script that sends your transit route, stop, or station lookup terms to official Hong Kong transport data endpoints. No evidence of hidden persistence, credential use, destructive behavior, or unrelated data access was found.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill explicitly instructs running a bundled Python script that queries external KMB/LWB, Citybus, and MTR endpoints, so network capability is clearly present while no permission declaration is shown. This is not inherently malicious in a transport-ETA skill, but undeclared network access reduces transparency and can surprise the host environment or users, especially if permission gating or review relies on manifest declarations.

VirusTotal

66/66 vendors flagged this skill as clean.