Trein extended

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:10 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward Dutch train-query helper, with disclosed but manageable risks around installing the CLI and storing the NS API key.

Install only if you trust the upstream trein CLI source. Prefer setting NS_API_KEY as an environment variable for the session; if you use the config file, keep it out of shared or synced directories and restrict file permissions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:4
• Finding: Unpinned and Unverified Third-Party Executable Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 4 and 12-17 **Vulnerability Type**: Unpinned and unverified third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"clawdbot":{"emoji":"🚆","requires":{"bins":["trein"],"env":["NS_API_KEY"]},"primaryEnv":"NS_API_KEY","install":[{"id":"npm","kind":"node","package":"trein","bins":["trein"],"label":"Install trein (npm)"},{"id":"download-mac-arm","kind":"download","url":"https://github.com/joelkuijper/trein/releases/latest/download/trein-darwin-arm64","bins":["trein"],"label":"Download (macOS Apple Silicon)","os":["darwin"]},{"id":"download-mac-x64","kind":"download","url":"https://github.com/joelkuijper/trein/releases/latest/download/trein-darwin-x64","bins":["trein"],"label":"Download (macOS Intel)","os":["darwin"]},{"id":"download-linux","kind":"download","url":"https://github.com/joelkuijper/trein/releases/latest/download/trein-linux-x64","bins":["trein"],"label":"Download (Linux x64)","os":["linux"]}]}} ``` ```markdown ## Install npm (recommended): ```bash npm i -g trein ``` Or download a standalone binary from [GitHub Releases](https://github.com/joelkuijper/trein/releases). ``` ### Technical Analysis The Skill permits installation of the `trein` executable either from npm without an explicit version or from mutable GitHub `releases/latest` URLs. No checksum, cryptographic signature, immutable release identifier, or other integrity-verification mechanism is specified. Consequently, the artifact installed during one execution may differ from the artifact that was previously reviewed. Global npm installation also executes package installation behavior under the installing user's privileges. This creates a supply-chain trust boundary in which compromise of the npm publisher account, GitHub repository, release workflow, or associated distribution infrastructure could cause attacker-controlled code to be installed and executed. ...[truncated 1880 chars]
• Remediation: ## Remediation Suggestions 1. Pin the npm dependency to a specific audited version rather than installing the mutable latest version: ```bash npm i -g trein@<audited-version> ``` 2. Replace every `releases/latest` URL with an immutable, versioned GitHub release URL. 3. Publish SHA-256 or stronger checksums through a separately protected channel and verify the downloaded binary before execution. 4. Prefer cryptographic release signatures or provenance attestations, and document their verification procedure. 5. Use lockfile-backed, local installation where practical instead of global installation. 6. Review npm lifecycle scripts and release-build provenance before approving each version. 7. Run the CLI with least privilege and expose only the credentials and filesystem paths required for railway queries. 8. Add an update process that requires explicit review and checksum changes whenever the pinned dependency version is upgraded.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Session Persistence

Medium

• Category: Rogue Agent

Content

export NS_API_KEY="your-api-key"
```

Or create `~/.config/trein/trein.config.json`:
```json
{ "apiKey": "your-api-key" }
```

• Confidence: 91% confidence
• Finding: The skill instructs users to store the NS API key in a persistent plaintext config file under ~/.config/trein/trein.config.json. Persisting credentials on disk increases exposure to local compromise, accidental backup/sync leakage, and unintended reuse by other processes, especially in agent or shared environments where filesystem contents may outlive the session.

Static analysis

No suspicious patterns detected.