Security audit

sl-trafiklab-api

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Stockholm transit helper, but its preferences override can read from or overwrite arbitrary local paths instead of staying within the documented workspace preferences file.

Review before installing. The skill's normal transit lookups and saved favorites are understandable, but only use the documented `.sl/preferences.json` storage path and avoid invoking any command with `--preferences` pointing elsewhere. Treat saved favorites as location/routine data and remove them when no longer needed.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/cli.py:68
Finding: Unrestricted Preferences Path Permits Arbitrary File Read and Replacement
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill explicitly documents capabilities that read and write workspace files and make network requests, but it does not declare any tool scope or permission boundaries. This creates a least-privilege and transparency gap: an agent may invoke filesystem and network-capable code without an explicit policy surface for users or reviewers to assess and constrain those actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The skill states that favorite stops and routes are stored persistently in .sl/preferences.json, but it does not clearly warn the user at the point of use that data will be saved in the workspace. Persistent storage of travel preferences can expose sensitive routine or location information to other tools, future sessions, or anyone with workspace access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: This markdown file explains that .sl/preferences.json is loaded and modified and later documents save/remove commands, but it does not explicitly warn users that these commands persistently change local stored favorites. For markdown files, SQP-2 applies when behavior affecting user data is described without a clear warning or disclosure.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: Line L32 states that the language parameter accepts only sv or en, which is a natural-language locale restriction. Because the document does not mention user opt-in, fallback behavior, or a region-specific justification, this may conflict with language/locale policy expectations.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 98% confidence
Finding: The dependency is specified as pytest>=8.0.0, which allows any future major or minor release to be installed. This creates a supply-chain and reproducibility risk because builds may pull in unreviewed versions, including ones with breaking changes or newly introduced vulnerabilities.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
pytest>=8.0.0

Unverifiable Dependency: pytest has 2 known advisory(ies) (CVE-2025-71176 (pytest has vulnerable tmpdir handling); CVE-2025-71176 (pytest has vulnerable tmpdir handling)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 91% confidence
Finding: Because pytest is not pinned, it is not possible to verify whether the installed version includes fixes for the referenced advisory affecting tmpdir handling. Even though this is a development/test dependency, an affected version could expose CI or local test environments to filesystem-related issues if vulnerable functionality is exercised.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.