railway-12306
Pass
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill makes HTTPS requests to
kyfw.12306.cn, the official Chinese Railway ticket system, to fetch real-time ticket availability. This is a well-known service and the primary data source for the skill. - [COMMAND_EXECUTION]: The skill uses Node.js to execute local scripts (
scripts/query_tickets.jsandscripts/query_tickets_demo.js) for ticket searching and data parsing. It also describes interactions with a locallunar-calendarskill to handle date conversions, which is standard behavior for specialized agents. - [DATA_EXFILTRATION]: No sensitive file access or unauthorized data transmission patterns were detected. The skill only processes public railway schedule data and does not handle user credentials or personal information.
- [PROMPT_INJECTION]: The instructions in
SKILL.mdare focused on functional processing and do not contain any attempts to bypass safety filters or override agent behavior. - [SAFE]: The code is well-documented, avoids obfuscation, and uses built-in Node.js modules (
https,url) without external dependencies, minimizing the supply chain risk.
Audit Metadata