ClawHub
Back to skill

Security audit

easytable-fpx

Security checks for vulnerabilities and agentic risk

Overview

The skill openly describes restaurant booking actions through your browser, with expected personal-data sharing and persistent pairing.

Trust and review the external CLI and browser extension before installing; their implementation remains outside this review. Keep browser access limited to easyTable, act only on authorized reservations, and verify the restaurant, guest details, and requested change before submitting. Creation and modification need a manually copied browser token. Minimize shared personal information, remove temporary booking/token files afterward, and revoke pairing when no longer needed.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

The reference adds booking creation and modification beyond the manifest's listed availability, lookup, and cancellation operations.

Medium
Category
Excessive Agency
Confidence
86% confidence
Finding

The manifest describes listing availability, finding bookings by phone, and cancelling them through one-shot CLI calls. This section additionally provides executable instructions to create and modify bookings, including submission endpoints, and requires manually extracting a Turnstile token in browser DevTools rather than completing the operation entirely through the advertised CLI workflow.

Content

No source excerpt is available for this finding.

The booking submission instructions omit a privacy warning about transmitting personal data to easyTable.

Medium
Category
Output Handling
Confidence
90% confidence
Finding

The instructions submit a booking payload to easyTable and direct modification requests to a second endpoint. That payload includes the guest's name and mobile number, with additional fields for email and address, but the file provides no user-facing warning that these details will be sent to an external service.

Content

No source excerpt is available for this finding.