mcp-server-12306
Warn
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's installation guide instructs users to execute code from an unverified third-party GitHub repository (
github.com/drfccv/mcp-server-12306.git) and install a package from PyPI (mcp-server-12306). These sources are not associated with a known trusted vendor, introducing a risk of executing unvetted code in the agent's environment. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes live data from the 12306 railway API. This creates a surface for indirect prompt injection, as malicious content embedded in the API responses could theoretically attempt to manipulate the agent's behavior.
- Ingestion points: API responses containing train schedules, station names, and ticket information retrieved from 12306.cn via
http_service.py. - Boundary markers: Absent; the skill does not specify the use of delimiters or warnings to help the agent distinguish between API data and its own instructions.
- Capability inventory: The server performs network requests to external railway services; the broader agent environment typically includes capabilities such as file system access or command execution which could be targeted by a successful injection.
- Sanitization: No evidence of data sanitization or validation of the API's return values is provided in the skill documentation.
Audit Metadata