Trein

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 5:30 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward Dutch Railways CLI helper, with normal but important cautions around installing a third-party executable and protecting the NS API key.

Install only if you trust the trein npm package or GitHub release source. Treat NS_API_KEY as sensitive: prefer setting it only for the shell/session that needs it, and if using the config file, keep it private and out of backups, screenshots, and repositories.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:4

Finding

Unpinned Third-Party Executables Installed Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 4 and 15–20
Vulnerability Type: Unverified and mutable third-party dependencies
Risk Level: Medium

Vulnerable Code

yaml

metadata: {"clawdbot":{"emoji":"🚆","requires":{"bins":["trein"],"env":["NS_API_KEY"]},"primaryEnv":"NS_API_KEY","install":[{"id":"npm","kind":"node","package":"trein","bins":["trein"],"label":"Install trein (npm)"},{"id":"download-mac-arm","kind":"download","url":"https://github.com/joelkuijper/trein/releases/latest/download/trein-darwin-arm64","bins":["trein"],"label":"Download (macOS Apple Silicon)","os":["darwin"]},{"id":"download-mac-x64","kind":"download","url":"https://github.com/joelkuijper/trein/releases/latest/download/trein-darwin-x64","bins":["trein"],"label":"Download (macOS Intel)","os":["darwin"]},{"id":"download-linux","kind":"download","url":"https://github.com/joelkuijper/trein/releases/latest/download/trein-linux-x64","bins":["trein"],"label":"Download (Linux x64)","os":["linux"]}]}}

markdown

## Install

npm (recommended):
```bash
npm i -g trein

Or download a standalone binary from GitHub Releases.

text

### Technical Analysis

The npm installation does not pin an audited package version or verify package integrity. The standalone installation options likewise use mutable `releases/latest/download/...` URLs and do not specify checksums or cryptographic signatures.

Consequently, the executable installed by this Skill may change after the Skill itself has been reviewed. The package and repository names are consistent with the declared project homepage, and the audited file contains no direct evidence that the current upstream artifacts are malicious. Exploitation therefore depends on compromise of an upstream publisher, package, release, account, or delivery channel.

### Attack Path

1. An attacker compromises the npm package publisher, GitHub repos
...[truncated 1216 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the npm dependency to a specific, reviewed version rather than installing the mutable latest release.
2. Pin standalone downloads to explicit release versions instead of using releases/latest.
3. Publish trusted SHA-256 or stronger checksums for every platform artifact and verify them before installation or execution.
4. Prefer cryptographically signed releases and enforce signature verification against a documented maintainer key.
5. Record the reviewed source revision and use reproducible builds where feasible.
6. Run the CLI with least privilege and expose NS_API_KEY only to the specific process that requires it.
7. Establish a controlled update process that reviews new versions before changing the pinned version or expected digest.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The skill explicitly recommends storing the NS API key in a persistent plaintext config file under the user's home directory. Persistent local storage increases the chance of credential exposure through backups, accidental file sharing, weak file permissions, or compromise by other local processes, making this a real though moderate credential-handling weakness.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

export NS_API_KEY="your-api-key"

text

Or create `~/.config/trein/trein.config.json`:
```json
{ "apiKey": "your-api-key" }

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The markdown tells users to export NS_API_KEY or place the API key in ~/.config/trein/trein.config.json, but it does not warn that this is sensitive credential material or advise protecting the file/environment. For a skill description, omission of a brief warning about credential handling is a user-disclosure gap.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.