12306 Train Query

• Outcome: Pass
• Latest audit: May 28, 2026, 7:08 AM
• Version:
  1.0.2

Overview

This appears to be a straightforward China Railway train lookup skill with disclosed network use and local output files.

Before installing, expect the skill to contact official 12306 websites, send the stations and date you query to those services, cache station metadata locally, and create HTML output files by default. Use a specific output path only when you intend to write there, and review future updates because publisher provenance is limited.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The generated HTML hard-codes `lang="zh-CN"` and uses Chinese-localized timestamps and UI text, which imposes a specific language/locale on all users. This file also builds Markdown output with Chinese text only, and there is no opt-in, fallback, or documented justification for the locale restriction.

VirusTotal

64/64 vendors flagged this skill as clean.