Security audit

easytable-fpx

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly transparent about managing easyTable bookings, but it gives shell workflows for real booking changes, personal-data submission, and manual anti-bot token reuse without enough confirmation or consent guardrails.

Review this skill carefully before installing. Use it only for bookings you are authorized to manage, confirm the exact booking details before any cancel, create, or modify action, and be aware that it may send personal contact details to easyTable through a browser-mediated workflow. Avoid the manual Turnstile-token workaround unless you understand and accept the automation and account/session implications.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The cancellation example is a one-shot destructive request against a real booking endpoint and provides no explicit confirmation, dry-run guidance, or warning to verify booking ownership before execution. In this skill context, signed-in browser access plus phone/booking identifiers could make accidental or unauthorized cancellations easier.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The documentation includes booking creation and modification flows even though the skill metadata only advertises availability checks, lookup, and cancellation. That scope expansion is security-relevant because it enables higher-risk state-changing actions involving personal data and anti-bot bypass-adjacent instructions without clear manifest disclosure or consent boundaries.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The booking create/modify instructions include transmission of personal data fields such as name, mobile, email, and address to a third-party service without any user-facing privacy or consent warning. Because these are state-changing operations against an external booking platform, the omission increases the risk of users or downstream agents sending sensitive data without informed consent or minimization.

Context-Inappropriate Capability

Low

Confidence: 93% confidence
Finding: The instructions tell the operator to open DevTools and manually extract a Cloudflare Turnstile token from a live browser session. This crosses the stated shell/CLI boundary and effectively instructs users to circumvent an anti-automation control by harvesting a single-use browser token for replay in scripted requests.

Static analysis

No suspicious patterns detected.