Security audit

12306 Query

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to do what it says: query China Railway 12306 and write local schedule reports and station-cache data, with no hidden persistence or credential access found.

Before installing, prefer a pinned or verified skill version instead of the unpinned README command. Expect the skill to contact 12306, cache station data locally, and write generated HTML reports; avoid using `--output` on paths you do not intend to overwrite.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: README.md:8
Finding: Unpinned Package Execution in the Documented Installation Command
Content: View full analysis
Remediation: View remediation
add ``` 2. Pin the Skill source to an immutable release tag or, preferably, a full commit digest. 3. Publish and verify cryptographic checksums or signatures for installation artifacts. 4. Document the expected package name, version, source repository, and artifact digest. 5. Use a lockfile-backed installation workflow where possible. 6. Run installation with the least-privileged account required and avoid elevated administrative execution. ]]>

T09 · Insecure Skill Coding Practices

Note

Location: scripts/query.mjs:192
Finding: Incomplete Encoding of Remote Ticket Data in Generated HTML
Content: View full analysis
\u2014'; if (val === '无') return '\u65E0'; if (val === '有') return '\u6709'; return `${val}`; } function buildHTML(tickets, from, to, travelDate, filterDesc) { const e = (s) => s.replace(/&/g, '&').replace(/ { const swz = t.swz !== '--' ? t.swz : t.tz !== '--' ? t.tz : '--'; const rw = t.rw !== '--' ? t.rw : t.dw !== '--' ? t.dw : '--'; const typeClass = t.trainCode[0]?.toLowerCase() || ''; const buyClass = t.canBuy === 'Y' ? 'yes' : 'no'; return ` ${e(t.trainCode)} ${e(t.departTime)}\u2192${e(t.arriveTime)} ${formatDuration(t.duration)} ${seatCell(swz)}${seatCell(t.zy)}${seatCell(t.ze)}${seatCell(rw)}${seatCell(t.yw)}${seatCell(t.yz)}${seatCell(t.wz)} ${t.canBuy === 'Y' ? '\u53EF\u8D2D' : '\u552E\u7F44'} `; ``` ### Technical Analysis Ticket fields are parsed from the remote 12306 API response and inserted into a generated HTML document. Several values do not receive context-appropriate encoding: - `seatCell()` inserts `val` directly into an HTML text context. - `formatDuration(t.duration)` can return the original remote value when parsing fails, after which it is inserted directly into HTML. - `typeClass` is derived from a remote train-code character and inserted into an HTML attribut ...[truncated 1736 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The README instructs users to install the skill via npx skills add kirorab/12306-skill without pinning a specific version or immutable reference. This creates a supply-chain risk: a later malicious or compromised release of the package/skill could be fetched and executed by users at install time, and README installation commands are especially risky because users often paste them directly into a shell.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill invokes Node.js scripts that query the 12306 official API, which implies network access, but the manifest does not declare any tool scope such as permissions or allowed-tools. This weakens sandboxing and review controls because the runtime capabilities needed by the skill are broader than what the manifest explicitly communicates, making it harder to enforce least privilege or detect unexpected network behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The generated HTML declares lang="zh-CN" and renders user-facing labels, status text, and timestamps in Chinese, while the markdown output also uses Chinese headings and labels. This imposes a specific language/locale on all users without opt-in or justification, which matches the language-policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This JSON file contains extensive natural-language content in Chinese for station_name and city fields, but provides no indication that the dataset is intentionally limited to Chinese locale or that users can opt into this language setting. For a general-purpose skill asset, this may violate language/locale policy by implicitly forcing one language without user choice or justification.
Content: No source excerpt is available for this finding.