Deutsche Bahn CLI

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:45 AM UTC
• Version: 1.0.0

Overview

This train-search skill is purpose-aligned, but it tells the agent to install and run code from an unverified local project path outside the reviewed skill package.

Review this before installing. Only use it if you already trust and have verified the `~/Code/bahn-cli` project and its dependencies. Prefer a version that bundles the CLI or pins an official repository, commit, and lockfile, and avoid running `npm install` or `node index.js` from an unspecified local path in a sensitive environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:13

Finding

Execution of Unverified External Project and Dependencies

Content

View full analysis

" "" [options] ``` ``` ### Technical Analysis The Skill instructs the Agent to enter `~/Code/bahn-cli`, install that project's dependencies, and execute its `index.js` file. However, the audited package does not include the referenced project, its source code, a package manifest, or a lockfile. It also does not identify an authenticated repository, immutable commit, or verified release from which the external project must originate. Consequently, the Agent trusts whatever content happens to occupy the mutable `~/Code/bahn-cli` path. Running `npm install` may download unreviewed dependencies and execute package lifecycle scripts such as `preinstall`, `install`, and `postinstall`. The subsequent `node index.js` command directly executes code from the same unverified directory. This creates a supply-chain execution boundary outside the audited Skill. The effective code may differ from what the Skill author intended and cannot be validated from the files in the project. ### Attack Path 1. An attacker, compromised development environment, or malicious setup process creates or modifies `~/Code/bahn-cli`. 2. The substituted project contains a malicious lifecycle script, malicious dependency, or modified `index.js`. 3. An Agent loads the Skill and follows its installation guidance. 4. `npm install` resolves the attacker's dependencies and may execute malicious lifecycle scripts. 5. Alternatively or additionally, the Agent invokes the documented search command and directly executes the substituted `index.js`. 6. ...[truncated 1170 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.