Mcporter Railway Query

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 5:53 PM UTC
• Version: 1.1.0

Overview

This skill is a disclosed read-only wrapper for querying China Railway information through mcporter, with a supply-chain caution around its npm install step.

Install only if you trust the mcporter npm package and your configured 12306 MCP server. For better safety, pin mcporter to a reviewed version or install it locally instead of globally before using the helper scripts.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:114

Finding

Unpinned Global npm Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:114-116
Vulnerability Type: Unpinned third-party package installed globally
Risk Level: Medium

Vulnerable Code

bash

npm install -g mcporter

The same installation instruction also appears in README.md:20-23 and README_zh.md:20-23.

Technical Analysis

The installation command retrieves the current version of the mcporter package without pinning an audited version or verifying its integrity or provenance. npm installations may execute package lifecycle scripts with the privileges of the invoking user. The global installation flag also makes the package available throughout the user's environment.

The project does not provide a lockfile, package checksum, vendored source, signature-verification procedure, or another reproducibility mechanism for this dependency. Consequently, the code installed by this command may differ from the version assessed when the Skill was reviewed.

This is a supply-chain exposure rather than evidence that the current mcporter package is malicious.

Attack Path

1. An attacker compromises the npm package, a maintainer account, or the relevant publication channel.
2. The attacker publishes a malicious or backdoored release under the expected package name.
3. A user follows the Skill's documented npm install -g mcporter instruction.
4. npm resolves and downloads the mutable current release rather than a previously reviewed version.
5. Malicious package code or lifecycle scripts execute with the installing user's privileges.
6. The globally installed CLI may subsequently execute attacker-controlled behavior whenever the Skill invokes mcporter.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the user performing the installation. Depending on that user's permissions and environment, the malicious dependency could read or modify user-accessible files, access configuration or credentials, ...[truncated 305 chars]

Remediation

View remediation

Remediation Suggestions

• Pin mcporter to an exact, reviewed version instead of installing the mutable latest release.
• Document the expected npm registry, package publisher, and reviewed package version.
• Verify package integrity and provenance through registry signatures, checksums, or equivalent controls before installation.
• Prefer a project-local dependency and lockfile over a global installation so dependency resolution is reproducible and constrained to the project.
• Review package lifecycle scripts and dependency trees before approving version updates.
• Apply automated dependency monitoring and require explicit security review before changing the pinned version.
• Keep the installation guidance consistent across SKILL.md, README.md, and README_zh.md.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The code is aligned with part of the description: it uses mcporter to query Chinese rail ticket information for a route and date, and it sorts results. However, the declared description claims broader capabilities that are not present in this code chunk. The script accepts only date, from-station, and to-station parameters, always sorts by startTime, and explicitly omits trainFilterFlags so it cannot filter by train type. There is also no implementation for time-range filtering, timetable lookup as a separate function, seat-availability-specific querying, or broader travel planning. This is therefore a description-to-behavior mismatch due to overstated functionality in the declared purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest description and the entire README content are presented in Chinese, which effectively forces a specific language for users. Under the policy, language-specific behavior should either offer a user choice or clearly document a justified locale constraint; neither is present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This file presents all user-facing instructions, headings, and parameter explanations in Chinese, which can amount to a language/locale policy issue if the skill implicitly forces one language without opt-in. There is no note that the skill is China-specific or that Chinese is an intentional locale constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The comments and runtime messages are written entirely in Chinese, including the usage and query output strings. This imposes a specific language on users without any opt-in or indication that the skill is intentionally limited to a Chinese-speaking context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.