Security audit
A nach B - AT Public Transport Service (VOR)
Security checks across malware telemetry and agentic risk
Overview
This skill is a straightforward Austrian public transport helper that calls a disclosed transit API and does not show persistence, credential access, local data collection, or destructive behavior.
Safe to install for transit lookups, with the caveat that arguments should be ordinary station names, station IDs, or small numeric counts. The scripts should ideally use a JSON-safe construction method such as jq to avoid malformed requests when input contains quotes or unexpected characters.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
63/63 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.