Matrix Mate - ITA Matrix Flight Search and Parse Tool

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 12:39 AM UTC
• Version: 1.0.3

Overview

This is a coherent local travel-parsing skill with disclosed behavior, but it has dependency and input-hardening issues users should account for.

Install only from a trusted, pinned release, run dependency updates/audits before use, and keep MATRIX_MATE_BASE_URL on loopback unless you deliberately trust the remote endpoint. Treat itinerary and fare-rule content as untrusted data, avoid very large manual payloads, and review parsed travel outputs before relying on them.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Warning

• Location: scripts/runtime/server-core.mjs:58

Finding

Untrusted trip data is interpolated into an executable agent prompt

Content

View full analysis

`${slice.origin.code}-${slice.destination.code}`) .join(', ') : 'unknown route'; const discrepancyLines = discrepancies.length ? discrepancies .slice(0, 5) .map((item) => `- [${item.severity}] ${item.field}: ${item.message}`) .join('\n') : '- No discrepancies reported.'; const truthLines = truthRows.length ? truthRows .slice(0, 6) .map((item) => `- ${item.concern}: ${item.value} (${item.scope})`) .join('\n') : '- No traveler truth-table rows returned.'; return { routeSummary, discrepancyLines, truthLines }; } ``` ```js server.registerPrompt( 'traveler-safe-audit-brief', { title: 'Traveler-safe audit brief', description: 'Create a grounded audit summary for an existing Matrix Mate trip.', argsSchema: TravelerSafeAuditPromptArgsSchema, }, async ({ tripId, focus }) => { const result = await client.getTrip(tripId); if (!result.ok || !result.payload) { return { description: `Trip ${tripId} could not be loaded`, messages: [createPromptMessage(`Trip ${tripId} could not be loaded from the local Matrix Mate app. Ask the user to retry after checking the trip id and local app health.`)], }; } const facts = buildAuditFacts(result.payload); return { description: `Travel ...[truncated 2588 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/runtime/contract.mjs:3

Finding

ITA Matrix URL validation accepts non-ITA hostnames

Content

View full analysis

/matrix\.itasoftware\.com\/itinerary/u.test(value), 'Use an ITA Matrix itinerary URL.'); ``` ### Technical Analysis The schema validates the entire serialized URL with a substring-oriented regular expression. It does not parse the URL and compare its hostname and pathname as separate components. As a result, a URL such as the following can satisfy the expression even though its actual destination is not ITA Matrix: ```text https://attacker.example/matrix.itasoftware.com/itinerary ``` Other URL components can also contain the expected text without making `matrix.itasoftware.com` the destination host. Passing Zod’s generic `.url()` check only establishes that the input is syntactically a URL; it does not enforce the intended origin. The accepted value is subsequently sent to the local Matrix Mate parser by `parse_matrix_link`. Whether the separate Matrix Mate application dereferences the supplied URL is outside the audited project, so downstream server-side request forgery is a conditional risk rather than a confirmed behavior. ### Attack Path 1. An attacker supplies a syntactically valid URL whose path or another component contains `matrix.itasoftware.com/itinerary`, while its actual hostname is attacker-controlled. 2. Zod’s `.url()` validation succeeds. 3. The regular-expression refinement succeeds because the expected substring appears somewhere in the complete URL. 4. `parse_matrix_link` forwards the deceptive URL to the local Matrix Mate endpoint at `/v1/intake/matrix-link`. 5. If the local application dereferences or otherwise trusts the submitted URL, it may contact an unintended destination or process attacker-controlled content as an ITA Matrix itinerary. ### Impact Ass ...[truncated 592 chars]

Remediation

View remediation

{ const parsed = new URL(value); if (parsed.protocol !== 'https:') { ctx.addIssue({ code: 'custom', message: 'The ITA Matrix URL must use HTTPS.', }); } if (parsed.hostname !== 'matrix.itasoftware.com') { ctx.addIssue({ code: 'custom', message: 'Use an ITA Matrix hostname.', }); } if (parsed.pathname !== '/itinerary') { ctx.addIssue({ code: 'custom', message: 'Use an ITA Matrix itinerary URL.', }); } if (parsed.username || parsed.password || parsed.port) { ctx.addIssue({ code: 'custom', message: 'Credentials and custom ports are not permitted.', }); } }); ``` Also: 1. Require the expected `search` parameter if it is necessary for parsing. 2. Reject URL credentials, custom ports, fragments, and unexpected path variants. 3. Repeat destination validation in the downstream Matrix Mate application before any network retrieval. 4. Disable redirects or validate every redirect destination against the same allowlist. 5. Add negative tests for attacker-controlled hosts, user-info confusion, subdomains, encoded paths, and expected text appearing only in query parameters or fragments. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/runtime/contract.mjs:14

Finding

Manual itinerary inputs lack payload size limits

Content

View full analysis

Remediation

View remediation

itaJson.length + rulesBundle.length <= 750_000, 'The combined manual itinerary payload is too large.', ); ``` 2. Enforce a total MCP request-size limit before parsing or copying request data. 3. Configure a corresponding request-body limit in the downstream Matrix Mate HTTP application. 4. Apply request timeouts and cancellation through `AbortController`. 5. Avoid retaining duplicate copies of large input strings where possible. 6. Add boundary tests for inputs immediately below, at, and above each configured limit. 7. Consider invocation throttling if multiple local callers can access the MCP server. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (13)

Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more

High

• Category: Supply Chain
• Confidence: 88% confidence

Finding

fast-uri 3.1.0 is associated with host confusion and malformed URL parsing issues, including SSRF-relevant cases. URL canonicalization bugs are dangerous in a tool that parses itinerary links, because security decisions based on misparsed hosts or authorities can allow untrusted destinations to be treated as safe or internal-only protections to be bypassed if this library is used in request validation paths.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: hono==4.12.9 — 16 advisory(ies): CVE-2026-56762 (Hono missing validation of cookie name on write path in setCookie()); CVE-2026-47676 (Hono: app.mount() strips mount prefix using undecoded path, causing incorrect ro); CVE-2026-47675 (Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie) +13 more

High

• Category: Supply Chain
• Confidence: 93% confidence

Finding

hono 4.12.9 has multiple published advisories affecting routing, cookies, and request/path handling. Since the MCP SDK depends on Hono for HTTP server behavior, a skill that may run a local runtime or transport inherits risk from these request-processing flaws, especially if untrusted local or browser-provided inputs reach that server layer.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ip-address==10.1.0 — 2 advisory(ies): CVE-2026-69192 (ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco); CVE-2026-42338 (ip-address has XSS in Address6 HTML-emitting methods)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

ip-address 10.1.0 is flagged for leading-zero parsing ambiguity and XSS in HTML-emitting methods. This is a real vulnerable dependency, but exploitability depends on whether express-rate-limit or surrounding code actually uses attacker-controlled IP representations or renders Address6 HTML output; the offline/local nature of the skill reduces but does not eliminate that risk.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: path-to-regexp==8.3.0 — 2 advisory(ies): CVE-2026-4923 (path-to-regexp vulnerable to Regular Expression Denial of Service via multiple w); CVE-2026-4926 (path-to-regexp vulnerable to Denial of Service via sequential optional groups)

High

• Category: Supply Chain
• Confidence: 86% confidence

Finding

path-to-regexp 8.3.0 is reported vulnerable to ReDoS/DoS through crafted route patterns or matching behavior. In a server-capable dependency graph like express/router/Hono, expensive path matching can be abused to consume CPU if attacker-controlled requests hit affected routes; the local/offline deployment lowers exposure relative to an internet-facing service, but it remains a genuine weakness if any HTTP listener is enabled.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 85% confidence

Finding

The README instructs users to install the skill via npx skills add <owner>/matrix-mate-offline-skill without pinning a specific version or immutable reference. That creates a supply-chain risk: a later malicious or compromised package release could be fetched and executed during installation, which is more concerning here because the skill also asks users to run additional local Node scripts afterward.

Content

No source excerpt is available for this finding.

Unbounded Output

Medium

• Category: Output Handling
• Confidence: 91% confidence

Finding

This is a real availability weakness: the document explicitly states that oversized itaJson / rulesBundle inputs have no size cap. An attacker or careless user could submit very large payloads to the local MCP/runtime path and cause excessive memory use, CPU consumption, latency, or token/processing cost, resulting in denial of service or degraded local performance rather than direct compromise.

Content

Scanner excerpt · SECURITY.md (reported line 43)May include surrounding context.

md

### 3) Oversized manual payloads
- Risk: very large `itaJson` / `rulesBundle` can increase latency/cost.
- Current mitigation: schema requires non-empty strings but no size cap.
- Recommended hardening: add max-size limits (for example 250-500 KB) in schema and UI.

## Reviewer quick checks

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest limits the skill to parsing ITA Matrix links, auditing fare rules, and producing traveler-safe summaries, and explicitly says not to use it for booking. This file nevertheless registers a get_future_booking_intent tool that retrieves booking-intent data for a trip, which goes beyond the stated offline parsing/audit scope and introduces a booking-adjacent capability.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: @hono/node-server==1.19.11 — 2 advisory(ies): CVE-2026-39406 (@hono/node-server: Middleware bypass via repeated slashes in serveStatic); GHSA-frvp-7c67-39w9 (Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encode)

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

The lockfile pins @hono/node-server 1.19.11, and the cited advisories describe path handling flaws in static file serving such as repeated-slash middleware bypass and Windows path traversal. Even though this skill is described as offline-first, MCP runtimes commonly expose local HTTP transports or helper servers, so vulnerable path normalization in a transitive server component can become reachable if static serving features are enabled.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: body-parser==2.2.2 — 1 advisory(ies): CVE-2026-12590 (body-parser vulnerable to denial of service when invalid limit value silently di)

Low

• Category: Supply Chain
• Confidence: 74% confidence

Finding

body-parser 2.2.2 is flagged for a denial-of-service condition involving invalid limit handling. This is a real dependency risk, but in this specific skill context the impact is reduced because a local/offline MCP tool is less likely to parse large volumes of hostile remote HTTP traffic unless it exposes an HTTP interface through the SDK stack.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: qs==6.15.0 — 3 advisory(ies): CVE-2026-82417 (qs: Denial of Service via Attacker Controlled isBuffer); CVE-2026-8723 (qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/u); CVE-2026-82562 (qs array-limit bypass via bracket-key comma parsing)

Low

• Category: Supply Chain
• Confidence: 78% confidence

Finding

qs 6.15.0 has advisories for denial-of-service and parser limit bypass behavior. This is a real dependency issue, but the effect is typically limited to request parsing of attacker-controlled query strings or form bodies, so in an offline-first local skill the practical risk is lower unless a reachable HTTP API is exposed to untrusted clients.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 23)May include surrounding context.

json

"mcp:config": "node scripts/print-offline-mcp-config.mjs"
  },
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.27.1",
    "zod": "^4.3.6"
  }
}

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 24)May include surrounding context.

json

},
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.27.1",
    "zod": "^4.3.6"
  }
}

Static analysis

No suspicious patterns detected.