ClawHub
Back to skill

Security audit

火车查询 - Train Ticket Inquiry - 极速数据

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed train-query helper that sends train search parameters to JisuAPI using a user-provided API key.

Install only if you are comfortable sending train search details and your JisuAPI AppKey to JisuAPI. Use a dedicated, quota-limited key if possible, avoid sharing logs that include request URLs, and rotate the key if it may have been exposed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
train.py:40
Finding

API Credential Exposed in URL Query Strings

Content
View full analysis
&trainno=G34 ``` HTTPS encrypts the request during transport, so the key is not exposed as plaintext to ordinary passive network observers. However, query strings may be recorded by the destination service, TLS-terminating infrastructure, reverse proxies, application performance monitoring systems, debugging tools, or exception telemetry. Unlike an authorization header, a query parameter is commonly retained as part of the full request URL. The requests are sent only to fixed, documented HTTPS endpoints under `api.jisuapi.com`; the reviewed code does not contain evidence of covert exfiltration or transmission to an unrelated host. The risk arises from the authentication mechanism and ...[truncated 1521 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill requires environment access to read an API key and network access to query a third-party train API, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates a governance gap: the runtime capabilities exceed what is transparently documented, making it harder to enforce least privilege and easier for future code changes to abuse env or network access unnoticed.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger description is broad enough that ordinary travel-related language may invoke the skill unintentionally. Over-broad activation can route user data or queries to an external API without clear user intent, increasing privacy and UX risk even if the underlying functionality is legitimate.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · train.py (reported line 14)May include surrounding context.

python
import requests


TRAIN_STATION2S_URL = "https://api.jisuapi.com/train/station2s"
TRAIN_LINE_URL = "https://api.jisuapi.com/train/line"
TRAIN_TICKET_URL = "https://api.jisuapi.com/train/ticket"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · train.py (reported line 15)May include surrounding context.

python
import requests


TRAIN_STATION2S_URL = "https://api.jisuapi.com/train/station2s"
TRAIN_LINE_URL = "https://api.jisuapi.com/train/line"
TRAIN_TICKET_URL = "https://api.jisuapi.com/train/ticket"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · train.py (reported line 16)May include surrounding context.

python
import requests


TRAIN_STATION2S_URL = "https://api.jisuapi.com/train/station2s"
TRAIN_LINE_URL = "https://api.jisuapi.com/train/line"
TRAIN_TICKET_URL = "https://api.jisuapi.com/train/ticket"

Static analysis

No suspicious patterns detected.