ClawHub
Back to skill

Security audit

SubwaySkill

Security checks for vulnerabilities and agentic risk

Overview

This looks like a legitimate NYC subway times skill, but users should review it because installation fetches mutable remote code and the CLI downloads and caches transit data with limited safeguards.

Install only if you trust the upstream GitHub module at install time. Prefer a pinned reviewed version or checksum-backed release, and expect the tool to make outbound requests to MTA-related endpoints and write GTFS cache files under `~/.cache/subwayskill/`. Consider running it with normal user privileges and resource limits if used in automation.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:23
Finding

Mutable and Unpinned Remote Installation Target

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
internal/schedule/schedule.go:80
Finding

Unbounded Network Responses and GTFS Archive Processing

Content
View full analysis
Remediation
View remediation
maxFeedSize { return nil, fmt.Errorf("response exceeds maximum size") } ``` 2. Reject responses whose declared `Content-Length` exceeds the configured limit. 3. Use separate limits for realtime protobuf feeds and static GTFS archives based on expected production sizes. 4. Configure `CheckRedirect` to restrict redirects to approved HTTPS hosts and limit the number of redirects. 5. Validate response content types where the upstream service provides reliable content-type metadata. 6. Inspect ZIP metadata before opening entries and reject archives with excessive entry counts, uncompressed sizes, or compression ratios. 7. Wrap each opened ZIP entry in a limiting reader and cap the total uncompressed bytes processed across all entries. 8. Limit CSV record sizes and the number of trips, services, stop times, and departures retained in memory. 9. Write downloads to a private temporary file, validate them, call `Sync` where appropriate, and atomically rename them into the cache only after successful validation. 10. Set restrictive cache permissions, handle cache-write errors, and impose a maximum cache size. 11. Add process-level memory and CPU limits when the CLI is executed by an Agent runtime. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill uses 'file_write' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 98)May include surrounding context.

md
## Data sources

- **Realtime**: MTA GTFS-RT feeds (no API key required)
- **Schedule**: [MTA static GTFS](https://api.mta.info/) — regular + supplemented (7-day lookahead with planned service changes)

## License

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README discloses that the tool automatically downloads and caches GTFS data under the user's home directory, but it does not clearly warn users up front that running certain commands causes network access and filesystem writes. This is a real transparency and consent issue: users, automation, or sandboxed environments may assume a read-only/local CLI and unintentionally permit outbound requests or persistent disk writes.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.