SRT

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:15 AM UTC
• Version: 1.1.1

Overview

This SRT booking skill is coherent, but it needs Review because it combines account credentials, long-running background automation, Discord reporting of booking details, and weak PID-file process control.

Install only if you are comfortable giving the skill your SRT account credentials and letting it make or cancel reservations under your account. Avoid the continuous monitoring mode unless you understand the background process, cron jobs, log location, Discord destination, and cleanup steps; do not use PID files you did not create, and prefer a pinned, reviewed SRTrain dependency version.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/reserve.py:348

Finding

Unverified PID File Allows Termination of Unrelated Processes

Content

View full analysis

Remediation

View remediation

/stat` and `/proc//cmdline`. 5. Verify that the PID file is a regular file owned by the current user and is not group- or world-writable. 6. Prefer retaining a process handle or using a dedicated authenticated local control channel when lifecycle management occurs within one supervising process. 7. Remove stale PID files after successful shutdown and refuse to act when any identity check fails. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned Runtime Dependency Handles SRT Account Credentials

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation claims path validation for SRT_DATA_DIR and --log-file, but this file provides no implementation evidence for that control. If the runtime does not actually enforce these restrictions, an attacker or unsafe prompt could direct logs, PID files, or cache data to arbitrary filesystem locations, potentially overwriting files or exposing sensitive data.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill advertises shell, environment, and file read/write behavior but does not declare any explicit tool scope or permission boundaries. That creates an over-privileged and opaque execution model where an agent may invoke sensitive capabilities without a documented least-privilege contract, increasing the chance of unintended credential exposure or filesystem changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill requires SRT account credentials in environment variables but gives no warning about secure handling, redaction, or process/log exposure. In agent and shell-based environments, environment variables can leak through debugging output, subprocess inheritance, crash reports, or misconfigured logging.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The markdown states Station names (Korean only) and later specifies extraction from Korean input, which imposes a language constraint in natural-language instructions. Because no user opt-in or alternative language handling is offered, this is a locale/language policy issue under the stated rules.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 92% confidence

Finding

The skill explicitly instructs launching a long-lived background process with nohup and separate cron jobs to monitor and terminate it. This introduces persistence behavior that can outlive the initiating session, making it harder to audit, easier to abuse for unattended activity, and more likely to leave residual processes or files containing sensitive state.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

bash

LOG_FILE=<choose_any_path>.log
PID_FILE=<choose_any_path>.pid
cd <project_dir> && nohup uv run --with SRTrain python3 scripts/srt_cli.py reserve retry \
  --train-id <id> --timeout-minutes 1440 --wait-seconds 10 \
  --log-file "$LOG_FILE" > /dev/null 2>&1 &
echo $! > "$PID_FILE"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The monitoring flow instructs background logging, log tailing, and Discord reporting, and the examples explicitly mention sending reservation numbers and seat information on success. Without sensitivity warnings or redaction requirements, this can disclose booking details and operational state through logs or third-party messages.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill extends beyond train reservation into cron-job orchestration and Discord messaging, which are not necessary for core booking functionality. Expanding into cross-system automation increases the attack surface and can enable persistence, unintended notifications, or data exfiltration of reservation details to third-party channels.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code presents operational status and error information in Korean, and the pattern continues throughout the file. Because the skill does not offer user language selection or explain that it is intentionally Korea-specific, it violates the language/locale policy for natural-language content.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill exposes process-management actions via user-supplied pid_file data and then calls os.kill() on the referenced PID. In the context of an SRT reservation tool, the ability to probe arbitrary process existence and send SIGTERM to arbitrary local processes is unnecessary and can be abused to disrupt unrelated processes if an attacker can influence the PID file path or contents.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code defines all CLI descriptions and argument help text in Korean only, and elsewhere in the file user-facing status/error messages are also Korean. Under the policy, forcing a specific language without user opt-in or clear justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This Python file contains multiple user-facing natural-language strings in Korean, beginning at L036-L037 and continuing throughout the module. Because the skill does not offer user opt-in for language selection or document that it is intentionally Korea-specific, it appears to force a specific language/locale in violation of the language-choice policy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code file contains user-facing natural-language strings such as examples, help text, and argument descriptions entirely in Korean. The file does not indicate that the locale is region-specific or provide an opt-in/choice for language, which can violate a language/locale policy requiring user choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.