Security audit

Railway 12306

Security checks for vulnerabilities and agentic risk

Overview

This skill is a China railway ticket lookup helper with some overstated or incomplete features, but I found no hidden persistence, credential theft, destructive behavior, or unrelated privileged access.

Install only if you are comfortable with a Chinese-language helper that makes public 12306 availability queries. Treat the advertised price comparison and cheapest/direct/transfer recommendations as incomplete, and verify fares, availability, and purchases on the official 12306 website or app.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (26)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: 代码的核心主用途仍然是12306火车票/余票查询，这与声明的大方向一致，没有发现明显越权或无关的外部资源访问；仅访问12306查询接口，车站代码转换也确实实现了。但声明中的多项核心能力与实际行为存在明显落差，属于描述与行为不一致。尤其是“价格对比”在代码中根本未获取价格数据；“最便宜”推荐被注释标明TODO，实际只是返回第一个车次；“中转推荐”和“农历节假日提醒”完全不存在。因此应判定为存在能力夸大和功能描述不准确的 mismatch。

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: 该代码的总体主题仍与火车票查询有关，但描述显著夸大了能力。代码没有访问12306或其他外部服务，因此不具备“实时”查询能力；其数据源完全是硬编码模拟数据。推荐逻辑也很有限，仅对时长排序实现“最快”，没有落实最便宜、直达、中转等声明能力。价格对比、车站代码转换、农历节假日提醒均未实现。虽然输出中包含余票和出行建议，且用途与铁路出行信息相关，但声明的核心功能与实际行为存在多项实质性不一致，因此应判定为描述与行为不匹配。

Ae1

High

Category: analysis-evasion
Content: node scripts/query_tickets.js \
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: node scripts/query_tickets.js \
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: node scripts/query_tickets.js \
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: node scripts/query_tickets.js \
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: node scripts/query_tickets.js \
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: node scripts/query_tickets.js \
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: node scripts/query_tickets.js \
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The skill description is presented as a Chinese-language assistant and the README provides no indication that other languages are supported or that users may choose their preferred language. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The README lists '多日期价格对比' as a current feature, and the manifest also advertises price comparison output. However, the TODO section later states '价格查询集成' is still pending, indicating the implemented skill does not actually support price retrieval needed for real price comparison. This is a semantic mismatch between the skill's claimed behavior and its documented actual state.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The activation description says the skill triggers not only on specific keywords like "12306" but also whenever a user "needs to query railway travel information," which is broad and ambiguous. That can overlap with ordinary travel-planning requests and may cause unintended invocation beyond narrowly scoped train-ticket lookup scenarios.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: At L031-L035 the skill states it only offers query capability, uses public query interfaces, and does not involve login or personal information. However, the implementation notes at L190-L195 explicitly describe adding a Referer and a simulated Cookie to outbound requests to avoid interception, which contradicts the plain read-only/no-login portrayal in the documentation and changes the apparent interaction model.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The top-level comment lists intelligent recommendation and multi-date price comparison as supported features, including a cheapest preference example. However, the recommend() function's cheapest branch contains a TODO and does not inspect any price data, directly contradicting the documented behavior.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The manifest and file header both advertise '多日期价格对比' and price-oriented recommendation, but the cheapest-path logic explicitly notes that price querying is not implemented and simply returns the first ticket. The actual behavior is schedule/availability querying only, so the claimed price-comparison capability is not matched by the code.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The comment says '直达优先', but the implementation selects the first train whose number does not include 'Z', which is not a valid directness check and instead filters by a train-code letter. This contradicts the documented intent because train-code class is not equivalent to whether a route is direct or requires transfers.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: The script is presented as a 12306 ticket query assistant, but the file explicitly uses mock in-memory data while the skill metadata claims real-time availability, smart recommendations, price comparison, station-code conversion, and holiday reminders. This mismatch can mislead users into making travel decisions based on fabricated or stale information, which is an integrity/deception issue rather than code execution risk.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The code labels one option as '经济实惠' and states a specific price advantage, but no price field or comparison logic exists in the dataset or code. This creates a false recommendation that could steer users toward suboptimal bookings based on invented cost claims.

Description-Behavior Mismatch

Low

Confidence: 61% confidence
Finding: The documentation states '零依赖（仅需Node.js内置模块)', which suggests a narrowly self-contained capability profile. But the same README describes real-time 12306 ticket querying, which necessarily depends on external 12306 network access even if no third-party packages are used. This is a mild description-behavior mismatch in how self-contained the skill is presented.

Natural-Language Policy Violations

Low

Confidence: 88% confidence
Finding: The skill content and examples are presented in Chinese only, and the document does not state that this is a China-specific, Chinese-language skill or offer a language choice. Under the policy, forcing a specific language without user opt-in can be a natural-language policy issue unless the locale constraint is explicitly justified.

Intent-Code Divergence

Low

Confidence: 77% confidence
Finding: The safety section at L331-L333 presents the skill as a simple public-data query tool that does not store user data or query history. Yet L194 documents sending a Cookie value in requests, which introduces request state and undermines the documentation's implication of fully stateless, minimal-data querying; while not direct history storage, it is an intent-level inconsistency in the privacy narrative.

Natural-Language Policy Violations

Low

Confidence: 88% confidence
Finding: The description string is entirely Chinese and the manifest does not state that the skill is intended only for Chinese-speaking users or provide any language/locale opt-in. Under the policy for natural-language violations, forcing a specific language without documented choice or justification can be a compliance issue.

Natural-Language Policy Violations

Low

Confidence: 82% confidence
Finding: This manifest-style JSON contains only Chinese-language station names as keys, which imposes a single language/locale in the skill data with no visible opt-in or alternative locale handling. Under the policy, forcing a specific language without user choice can be a natural-language locale violation unless clearly justified as region-specific.

Natural-Language Policy Violations

Low

Confidence: 96% confidence
Finding: This code file contains natural-language documentation and user-facing CLI messages exclusively in Chinese, which imposes a specific language on users. The policy allows locale constraints when they are explicitly justified or optional, but no such opt-in or justification is provided here.

Natural-Language Policy Violations

Low

Confidence: 95% confidence
Finding: This code presents its description, errors, recommendations, and notices entirely in Chinese, including all console output. Under the natural-language policy rule, forcing a specific language without user opt-in is a locale/language policy concern unless the constraint is explicitly documented and justified.