railil - Israel Railways train station schedule

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 5:15 AM UTC
• Version: 1.0.1

Overview

This is a coherent Israel Rail schedule skill, with the main caution being its unpinned global npm CLI install.

Install this only if you want an Israel Rail schedule CLI. Prefer pinning or reviewing the railil npm package version before installation, and install/run it as a normal user or in a sandbox if you want to limit exposure from third-party npm code.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:6

Finding

Unpinned Third-Party Package Installed Globally

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 6 and 14–16
Vulnerability Type: Unpinned and globally installed npm dependency
Risk Level: Medium

Vulnerable Code

yaml

metadata: {"clawdbot":{"emoji":"🚆","requires":{"bins":["railil"]},"install":[{"id":"node","kind":"node","package":"railil","bins":["railil"],"label":"Install railil (npm)"}]}}

bash

npm install -g railil

Technical Analysis

The Skill instructs the environment to install the railil npm package globally without specifying a reviewed version, package integrity hash, or lockfile. Consequently, npm resolves the mutable package version associated with the applicable registry tag at installation time.

npm packages may execute lifecycle scripts during installation. Because this artifact contains only documentation and no dependency source code, the behavior of the downloaded package and its installation scripts cannot be audited from the project. The declared package name is consistent with the stated GitHub project, and there is no evidence in the audited artifact that the current package is malicious. Nevertheless, the unpinned global installation creates a supply-chain exposure if a future package version, maintainer account, or registry artifact is compromised.

Attack Path

1. An attacker compromises the npm package, a maintainer account, or the package publication process.
2. The attacker publishes a malicious release under the version or registry tag resolved by the unpinned package declaration.
3. A user or agent follows the Skill installation instructions and runs npm install -g railil.
4. npm downloads the attacker-controlled release.
5. Malicious lifecycle scripts can execute during installation, or malicious code can execute when the installed railil command is invoked.
6. The payload runs with the privileges of the account performing the installation and can affect resources accessible to that ac ...[truncated 495 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin railil to an explicitly reviewed version in both the metadata and installation example, such as railil@X.Y.Z.
2. Record and verify the expected package integrity digest or use a lockfile in a local, reproducible installation workflow.
3. Verify npm registry provenance, publisher identity, and correspondence between the reviewed repository source and published package.
4. Prefer a project-local installation over npm install -g to limit modifications to the global environment.
5. Install with lifecycle scripts disabled using --ignore-scripts when the reviewed package does not require them.
6. Run the CLI under a least-privileged account or sandbox with restricted filesystem, credential, and network access.
7. Establish a dependency-update review process so that version changes are audited before deployment.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The description and heading explicitly position the skill as an Israel Rail schedule tool, which imposes a locale-specific scope. The file does not state that this regional limitation is optional or explain a policy-justified reason for restricting the skill to that locale.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.