Publish service-change feed

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:48 PM UTC
• Version: 1.0.0

Overview

The skill’s GTFS checking workflow is clear, but its setup can pull changing third-party code and it enables automatic use of a remote service.

Install only if you trust the PowMCP source and are comfortable with a remote service receiving direct public GTFS Schedule URLs. Prefer a pinned version or reviewed commit before running the npx install command, and do not provide private feeds, authenticated links, credentials, or sensitive query strings.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:37
• Finding: Unpinned Third-Party Skill Installation Creates a Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md`, lines 37-40 **Vulnerability Type**: Unpinned third-party package and repository installation **Risk Level**: Medium ### Vulnerable Code ```markdown ## Connect once ``` npx skills add powmcp/skills --skill publish-service-change-feed ``` ``` ### Technical Analysis The documented setup command invokes an unpinned package through `npx` and installs Skill content from the mutable `powmcp/skills` repository reference. It does not specify an exact package version, repository commit, checksum, signature, or integrity metadata. As a result, the code and Skill content retrieved when a user runs this command may differ from the content that was reviewed during this audit. Compromise of the package registry entry, upstream repository, publisher account, or a mutable release could cause the installation process to retrieve attacker-controlled code or instructions. The external MCP endpoint documented elsewhere in the project is required for the declared remote GTFS validation functionality and is disclosed to users. The project also limits validation inputs to public, unauthenticated GTFS URLs and warns users not to repeat credentials. No confirmed secret collection or hidden exfiltration behavior was found. The confirmed issue is therefore the mutable and unverified installation path, rather than the disclosed GTFS validation request itself. ### Attack Path 1. An attacker compromises the npm package used by `npx`, the `powmcp/skills` repository, a maintainer account, or another mutable upstream distribution component. 2. The attacker publishes modified installation logic or malicious Skill content under the same unpinned identifier. 3. A user follows the installation command in `SKILL.md`. 4. `npx` retrieves and runs the currently available package, which then obtains Skill content from the mutable upstream reference. 5. The substituted code executes during installation ...[truncated 987 chars]
• Remediation: ## Remediation Suggestions 1. Pin the `npx` package to an exact, reviewed version rather than resolving the latest available release. 2. Pin the Skill repository to a specific immutable commit hash or signed release tag. 3. Publish expected cryptographic checksums or signed provenance for the installed files and verify them before activation. 4. Prefer a declarative installation method that does not execute remotely retrieved package lifecycle code where feasible. 5. Use lockfiles and package-manager integrity metadata for all transitive dependencies involved in installation. 6. Run installation in a restricted environment with least-privilege filesystem access, no unnecessary credentials, and limited network access. 7. Document the exact expected files and versions so users can compare installed content with the reviewed release. 8. Establish dependency monitoring and a release-signing process for the npm package, repository, and MCP integration.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

## Structurally unassessable cases

The tools cannot assess a portal page, local path, authenticated resource, GBFS feed, or GTFS-Realtime feed because the input contract requires directly hosted public GTFS Schedule ZIP bytes.
The tools do not judge whether scheduled service occurs in the real world. That requires human schedule review.
The comparison cannot support a same-agency regression claim when the inputs belong to different agencies or when fewer or more than two URLs are supplied.
Distributor-specific acceptance remains outside the measured profile and must be reviewed against the applicable distributor's rules.

• Confidence: 85% confidence
• Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill enables allow_implicit_invocation without any visible trigger constraints, exclusions, or user-confirmation guardrails. That can cause the agent to invoke an external MCP tool based on loose relevance matching, increasing the chance of unintended network calls, processing of sensitive URLs or feed data, and user-confusing actions without explicit consent.

Static analysis

No suspicious patterns detected.