Traffic-Data

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 10:19 PM UTC
• Version: 1.0.0

Overview

This is a disclosed traffic-query skill that reads only named API-key environment variables and makes purpose-aligned map API requests, though its docs and dependencies need cleanup.

Install only if you are comfortable giving this Node CLI the listed map/SCATS API keys and allowing outbound requests to map providers. Before production use, fix the missing/incorrect command documentation, document the config command, and update or pin the HTTP dependencies after auditing them.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior does not match the detected capabilities: advertised SCATS and incident support may be incomplete, while an undeclared configuration-inspection capability exists. Behavior mismatches are dangerous because they undermine operator trust and can hide functionality that exposes configuration, secrets, or unexpected data flows beyond the user-approved purpose.

Credential Access

High

• Category: Privilege Escalation

Content

const axios = require('axios');

// Get API keys from environment
const BAIDU_MAP_KEY = process.env.BAIDU_MAP_KEY || '';
const GAODE_MAP_KEY = process.env.GAODE_MAP_KEY || '';
const SCATS_API_KEY = process.env.SCATS_API_KEY || '';

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

async function queryRoad(city, road) {
  if (!GAODE_MAP_KEY && !BAIDU_MAP_KEY) {
    console.log('Error: Please configure map API key in .env file');
    console.log('GAODE_MAP_KEY or BAIDU_MAP_KEY required');
    return;
  }

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

async function queryRoad(city, road) {
  if (!GAODE_MAP_KEY && !BAIDU_MAP_KEY) {
    console.log('Error: Please configure map API key in .env file');
    console.log('GAODE_MAP_KEY or BAIDU_MAP_KEY required');
    return;
  }

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Known Vulnerable Dependency: axios==1.13.5 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: The lockfile pins axios 1.13.5, and the supplied advisories include high-risk issues such as NO_PROXY normalization bypass leading to SSRF as well as prototype-pollution-related MITM/credential theft scenarios. In a traffic-data skill that makes outbound HTTP requests to external APIs, a vulnerable HTTP client is directly security-relevant because it may allow request routing bypasses, credential leakage, or response tampering depending on how the library is used.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 86% confidence
• Finding: form-data 4.0.5 is reported as vulnerable to CRLF injection via unescaped multipart field names and filenames. If this skill ever constructs multipart requests using attacker-influenced values, an attacker may be able to manipulate request boundaries or inject crafted headers/content, potentially altering requests sent to upstream services.

Known Vulnerable Dependency: axios==1.13.5 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 96% confidence
• Finding: The package allows resolution to an axios version reported as vulnerable, including SSRF and man-in-the-middle/prototype-pollution-related issues. Because this skill appears to fetch real-time traffic and incident data from remote services, a vulnerable HTTP client can expose requests, credentials, or internal network access paths if the surrounding code uses proxies, attacker-influenced URLs, or unsafe object handling.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill declares environment-variable requirements in metadata but does not define an explicit tool/permission scope. That creates an authorization and transparency gap: an agent or reviewer cannot easily tell what sensitive resources the skill expects to access, increasing the risk of unintended secret exposure or over-broad execution in permissive runtimes.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The natural-language content from L09 onward is presented in Chinese, including setup and usage instructions, with no indication that the skill is region-specific or that users can opt into another language. This can violate language/locale policy when a skill forces a specific language without user choice.

Known Vulnerable Dependency: follow-redirects==1.15.11 — 1 advisory(ies): CVE-2026-40895 (follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Ta)

Low

• Category: Supply Chain
• Confidence: 89% confidence
• Finding: follow-redirects 1.15.11 is flagged for leaking custom authentication headers across cross-domain redirects. Because axios depends on this package and this skill likely accesses traffic or SCATS endpoints over HTTP(S), a malicious or compromised upstream service could potentially induce redirects that expose bearer tokens, API keys, or other sensitive headers to an attacker-controlled domain.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"scats": "node scats.js"
  },
  "dependencies": {
    "axios": "^1.6.0"
  }
}

• Confidence: 92% confidence
• Finding: The dependency is specified with a caret range (^1.6.0), which allows installation of newer 1.x releases that may change over time and can unexpectedly introduce vulnerable versions or break reproducibility. In a skill that queries external traffic data over the network, a drifting HTTP client dependency increases supply-chain and patch-management risk.

Static analysis

No suspicious patterns detected.