DB Travel

• Analyzed: May 12, 2026, 4:28 AM
• Findings: 1
• Version: 1.0.0
• Hash: 78c77fe9b091a2df95b3dc1010592c6e4eaa2942081f0597b422d379af7a8605
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is a straightforward client for the public Deutsche Bahn API (v6.db.transport.rest). The `SKILL.md` provides clear instructions for the AI agent on how to use the `db-travel.py` script and format its output, without any evidence of prompt injection attempts to manipulate the agent maliciously. The `db-travel.py` script uses standard Python libraries for HTTP requests and argument parsing, exclusively targeting the specified public API endpoint. It does not access local files, environment variables, execute arbitrary commands, or attempt any form of data exfiltration or persistence. All user inputs are passed as URL parameters or path segments to the remote API, which is standard for API clients and does not introduce local vulnerabilities.