Hong Kong Bus ETA | 香港巴士預計到達時間

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:19 PM UTC
• Version:
  1.0.2

Overview

This is a disclosed Hong Kong bus arrival lookup skill that queries public transit data and stores local cache files for faster results.

Before installing, expect the skill to run local Python scripts, contact Hong Kong public transit/open-data services, and create cache files inside its scripts directory. Do not provide secrets; use normal argument passing for route and stop names to avoid shell quoting issues.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill advertises shell execution, network access, and local file writes, but these capabilities are not declared through a formal permission mechanism; they are only described in markdown metadata/instructions. That creates a policy-enforcement gap: an agent or platform may execute commands with broader trust than intended, and user-controlled parameters such as route/stop names increase risk if the runtime interpolates them into shell commands unsafely.

VirusTotal

64/64 vendors flagged this skill as clean.