Security audit

Maejongdeok

Security checks across malware telemetry and agentic risk

Overview

This booking skill is mostly aligned with its purpose, but it can submit medical-adjacent appointment details to external services without a clear final consent step.

Review this carefully before installing. It is not showing evidence of malware or data theft, but users should understand that booking details and any phone number they provide may be sent to BeautsGO/Yestokr, and price queries use another external API. Install only if that data sharing is acceptable and preferably after the publisher adds an explicit final confirmation step before booking submission.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The skill metadata and description present the capability as an informational hospital booking assistant, but the documented behavior includes collecting user data, submitting bookings to external APIs, opening external pages, and interacting with third-party services. This mismatch can mislead users and downstream reviewers about the true data flows and privileges involved, increasing the risk of unauthorized sharing of personal or medical-adjacent information with external services.

Context-Inappropriate Capability

Medium

Confidence: 77% confidence
Finding: The file invokes the system shell to launch a browser using string-built commands (`open`, `start`, `xdg-open`). Even with hostname allowlisting, shell execution increases attack surface and can create command-injection or argument-handling risks if URL validation is bypassed, extended later, or behaves differently across platforms.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The booking flow sends user-provided contact information and appointment details to a third-party API without clearly informing the user at the point of submission or obtaining explicit consent. Because the data includes personal contact details and scheduling information, this creates a privacy and compliance risk, especially in a healthcare-adjacent context where users may reasonably expect stronger disclosure.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The manifest advertises action-oriented capabilities such as one-click booking and online consultation, but it does not define clear activation constraints or narrow trigger conditions in the manifest itself. In a skill that can transmit user contact information to an external booking API, vague action scope increases the risk of unintended invocation, ambiguous consent, or users not understanding when their data will be sent.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: api/skill.js:25