ClawHub
Back to skill

Security audit

Tmp.6y6CG0U2aH

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for restaurant bookings, but it depends on an unpinned browser extension that can bridge into the user's live booking tab and handle personal reservation data.

Review the fetchproxy extension source, version, update channel, and browser permissions before installing. Use it only with the intended easyTable tab open, confirm booking details carefully before create/modify/cancel, and avoid using the extension in a browser profile containing unrelated sensitive sessions unless its host permissions are tightly limited.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:9
Finding

Unpinned Browser Extension Exposes Sensitive Browser Context to Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 9–16 and 34–38
Vulnerability Type: Unpinned third-party browser extension with access to sensitive browser state
Risk Level: Medium

Evidence

text
easyTable is a restaurant table-booking system. Each restaurant has a public
booking widget at `https://book.easytable.com/book/?id=<restaurantId>` — the
`id` is the only identifier (there's no login). This MCP drives that widget
through the user's own signed-in, Cloudflare-cleared browser tab via the
fetchproxy bridge; the site blocks any server-side request.

## Setup (one time)

1. Install the fetchproxy browser extension (https://github.com/chrischall/fetchproxy).
2. Open a booking widget in Chrome: `https://book.easytable.com/book/?id=<restaurantId>`.
   Let the page finish loading — its Cloudflare Turnstile check solves itself.
3. The first tool call prints a one-time pair code; approve it in the extension.
text
`create` and `modify` submit a Cloudflare Turnstile token the MCP reads from
the widget tab's hidden input, so a `book.easytable.com/book/?id=<id>` tab must
be open and loaded when you confirm. The token is single-use and expires after
a few minutes; if a create fails on the token, reload the tab and retry.
`cancel` needs no token.

Technical Analysis

The Skill requires installation of a browser extension from a personal GitHub repository, but does not pin an immutable commit or reviewed release, provide a checksum, document required browser permissions, or specify integrity-verification procedures. The extension acts as a bridge into the user's Cloudflare-cleared browser context and is used to read a Turnstile token from page state.

This creates a supply-chain trust boundary around a component with potentially sensitive browser access. If the repository, release process, distribution channel, or extension itself is compromised, the dependen ...[truncated 2176 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the extension to an immutable, reviewed commit or signed release rather than a mutable repository reference.
  2. Publish and verify cryptographic checksums or signatures for the reviewed extension artifact.
  3. Document all requested browser permissions and remove permissions that are not essential to easyTable reservations.
  4. Restrict host access and bridged requests to https://book.easytable.com/; deny arbitrary destinations and unrelated tabs.
  5. Prevent access to unrelated cookies, storage, headers, browsing history, and page content.
  6. Limit page-state access to the minimum fields required for the current operation and avoid retaining Turnstile tokens or personal data.
  7. Publish the MCP and extension source and build process so reviewers can verify destination restrictions, data handling, pairing security, and confirmation gates.
  8. Require explicit user approval immediately before every create, modify, or cancel operation, and bind that approval to the displayed restaurant, customer, time, party size, and booking action.
  9. Prefer a narrowly scoped integration that communicates directly with easyTable where technically possible, rather than a general-purpose browser request bridge.
  10. Add a clear privacy disclosure describing what information is read, transmitted, retained, and exposed to the extension.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.