Security audit

Scotty - AT Public Transport Service (ÖBB)

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent ÖBB travel-planning skill with no persistence or privilege behavior, but its scripts should handle user input more safely and users should know trip queries are sent to ÖBB.

Reasonable to install if you want ÖBB timetable helpers, but treat travel searches as data shared with ÖBB. Avoid passing untrusted or unusual station/date/time/count strings until the scripts are updated to build JSON with jq and validate numeric/date/time inputs.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (5)

T09 · Insecure Skill Coding Practices

Warning

Location: search-station.sh:15
Finding: Unescaped station query permits JSON request injection
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: arrivals.sh:25
Finding: Unvalidated arrival parameters permit JSON request injection
Content: View full analysis
Remediation: View remediation
= 1 && MAX <= 100 )) || { echo "Error: max-results must be an integer from 1 to 100" >&2 exit 1 } ``` ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: departures.sh:25
Finding: Unvalidated departure parameters permit JSON request injection
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: trip.sh:26
Finding: Trip search arguments and external location IDs permit JSON request injection
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: disruptions.sh:7
Finding: Unvalidated disruption result count permits raw JSON injection
Content: View full analysis
Remediation: View remediation
= 1 && MAX <= 100 )) || { echo "Error: max-results must be an integer from 1 to 100" >&2 exit 1 } ``` Then use typed JSON generation: ```bash payload=$(jq -n --argjson max "$MAX" '{ id: "1", ver: "1.67", lang: "deu", auth: {type: "AID", aid: "OWDL4fE4ixNiPBBm"}, client: {id: "OEBB", type: "WEB", name: "webapp", l: "vs_webapp"}, formatted: false, svcReqL: [{ req: { himFltrL: [{type: "PROD", mode: "INC", value: "255"}], maxNum: $max }, meth: "HimSearch" }] }') ``` Use `curl --fail-with-body --silent --show-error` and check the API response for error fields before passing it to the output filter. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The skill is explicitly designed to query an external ÖBB endpoint, and the examples show station names, trip endpoints, dates, and times being sent off-platform without any stated user-facing disclosure. While this is expected functionality for a travel planner, travel queries can still reveal location patterns or itinerary details, so the absence of privacy/network transparency is a real but low-severity issue.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.