Security audit

Skanetrafiken Trip Planner

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent public-transit trip-planning skill, with ordinary network use and a couple of implementation hardening issues users should understand.

Before installing, be aware that trip searches send the locations or coordinates you provide to Skånetrafiken. Prefer a pinned installer version instead of clawdhub@latest when possible, and avoid running the bundled shell scripts with elevated privileges or on a hostile shared machine because their temporary-file handling is not fully hardened.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: README.md:10
Finding: Mutable Package Installer Executed Without Version or Integrity Pinning
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: journey.sh:224
Finding: Predictable Journey Response Temporary File Allows Symlink-Based File Overwrite
Content: View full analysis
&2 rm -f /tmp/skanetrafiken_response_$$.json exit 1 fi RESPONSE=$(cat /tmp/skanetrafiken_response_$$.json) rm -f /tmp/skanetrafiken_response_$$.json ``` ### Technical Analysis The script constructs its temporary filename from the process ID and places it directly in the shared `/tmp` directory: ```text /tmp/skanetrafiken_response_.json ``` Process IDs are observable or guessable, and the script does not create the file atomically with exclusive-create semantics. It also does not verify whether the path already exists or is a symbolic link before passing it to `curl -o`. An attacker able to create the predicted path before `curl` opens it can substitute a symbolic link to another file. If operating-system symlink protections do not block the operation, `curl` follows the link and truncates or overwrites the target with the API response. The exit trap removes the predictable path but does not prevent the initial symlink traversal. System-level protections such as Linux `fs.protected_symlinks` may reduce exploitability in some multi-user configurations, but the script itself does not enforce safe temporary-file handling. ### Attack Path 1. A local attacker observes or predicts the PID that will be assigned to `journey.sh`. 2. Before the `curl` operation, ...[truncated 1259 chars]
Remediation: View remediation
&2 exit 1 } trap 'rm -f -- "$TEMP_RESPONSE"' EXIT HTTP_CODE=$(curl -s --max-time 30 -w "%{http_code}" --compressed \ "${BASE_URL}?${PARAMS}" \ -H "search-engine-environment: TjP" \ -H "accept: application/json" \ -H "user-agent: skanetrafiken-agent-skill/1.1" \ -o "$TEMP_RESPONSE") RESPONSE=$(cat -- "$TEMP_RESPONSE") ``` Additional hardening measures: 1. Set a restrictive umask, such as `umask 077`, before creating temporary files. 2. Prefer a private temporary directory created with `mktemp -d` when several related files are required. 3. Quote every temporary-path expansion. 4. Avoid constructing shared temporary paths from PIDs, timestamps, usernames, or other predictable values. 5. Do not run the script with elevated privileges unless strictly necessary. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: search-location.sh:39
Finding: Predictable Location Search Temporary File Allows Symlink-Based File Overwrite
Content: View full analysis
&2 rm -f /tmp/skanetrafiken_points_$$.json exit 1 fi RESPONSE=$(cat /tmp/skanetrafiken_points_$$.json) rm -f /tmp/skanetrafiken_points_$$.json ``` ### Technical Analysis The search script writes its HTTP response to a predictable PID-derived path in the globally shared `/tmp` directory: ```text /tmp/skanetrafiken_points_.json ``` The file is not created securely before being supplied to `curl`, and the script performs no ownership, file-type, or symbolic-link validation. A local attacker can therefore attempt to pre-create the expected path as a symbolic link. Where operating-system protections permit symbolic-link traversal, `curl -o` follows that link and writes the location-search response into the linked target. The cleanup trap only removes the pathname after use and does not address the unsafe file creation. ### Attack Path 1. A local attacker determines or predicts the process ID expected for a future `search-location.sh` invocation. 2. The attacker creates `/tmp/skanetrafiken_points_.json` as a symbolic link to a victim-writable target. 3. The victim invokes the location-search script. 4. `curl` follows the pre-existing symbolic link when opening its output file. 5. The ...[truncated 831 chars]
Remediation: View remediation
&2 exit 1 } trap 'rm -f -- "$TEMP_POINTS"' EXIT HTTP_CODE=$(curl -s --max-time 30 -w "%{http_code}" --compressed \ "https://www.skanetrafiken.se/gw-tps/api/v2/Points?name=${ENCODED_QUERY}" \ -H "search-engine-environment: TjP" \ -H "accept: application/json" \ -H "user-agent: skanetrafiken-agent-skill/1.1" \ -o "$TEMP_POINTS") RESPONSE=$(cat -- "$TEMP_POINTS") ``` Additional hardening measures: 1. Apply `umask 077` before creating temporary data. 2. Use `${TMPDIR:-/tmp}` rather than assuming a fixed temporary directory. 3. Quote all references to the generated path. 4. Use a private `mktemp -d` directory if the implementation later requires multiple files. 5. Avoid running this utility as a privileged user. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (44)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.
md
./search-location.sh <query> [limit]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 250)May include surrounding context.
md
./search-location.sh <query> [limit]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 251)May include surrounding context.
md
./search-location.sh <query> [limit]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 284)May include surrounding context.
md
./search-location.sh <query> [limit]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 290)May include surrounding context.
md
./search-location.sh <query> [limit]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 296)May include surrounding context.
md
./search-location.sh <query> [limit]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 344)May include surrounding context.
md
./search-location.sh <query> [limit]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 345)May include surrounding context.
md
./search-location.sh <query> [limit]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 346)May include surrounding context.
md
./search-location.sh <query> [limit]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 349)May include surrounding context.
md
./search-location.sh <query> [limit]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 350)May include surrounding context.
md
./search-location.sh <query> [limit]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 359)May include surrounding context.
md
./search-location.sh <query> [limit]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 360)May include surrounding context.
md
./search-location.sh <query> [limit]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 361)May include surrounding context.
md
./search-location.sh <query> [limit]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 364)May include surrounding context.
md
./search-location.sh <query> [limit]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 373)May include surrounding context.
md
./search-location.sh <query> [limit]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 374)May include surrounding context.
md
./search-location.sh <query> [limit]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 375)May include surrounding context.
md
./search-location.sh <query> [limit]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 376)May include surrounding context.
md
./search-location.sh <query> [limit]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 377)May include surrounding context.
md
./search-location.sh <query> [limit]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 380)May include surrounding context.
md
./search-location.sh <query> [limit]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 381)May include surrounding context.
md
./search-location.sh <query> [limit]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 382)May include surrounding context.
md
./search-location.sh <query> [limit]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 391)May include surrounding context.
md
./search-location.sh <query> [limit]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 392)May include surrounding context.
md
./search-location.sh <query> [limit]

Static analysis

No suspicious patterns detected.