railway-12306

Pass

Audited by Gen Agent Trust Hub on Jun 19, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill makes HTTPS requests to kyfw.12306.cn, the official Chinese Railway ticket system, to fetch real-time ticket availability. This is a well-known service and the primary data source for the skill.
  • [COMMAND_EXECUTION]: The skill uses Node.js to execute local scripts (scripts/query_tickets.js and scripts/query_tickets_demo.js) for ticket searching and data parsing. It also describes interactions with a local lunar-calendar skill to handle date conversions, which is standard behavior for specialized agents.
  • [DATA_EXFILTRATION]: No sensitive file access or unauthorized data transmission patterns were detected. The skill only processes public railway schedule data and does not handle user credentials or personal information.
  • [PROMPT_INJECTION]: The instructions in SKILL.md are focused on functional processing and do not contain any attempts to bypass safety filters or override agent behavior.
  • [SAFE]: The code is well-documented, avoids obfuscation, and uses built-in Node.js modules (https, url) without external dependencies, minimizing the supply chain risk.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 19, 2026, 04:52 PM